CVE-2026-10833 is a stored cross-site scripting vulnerability in the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns WordPress plugin. The issue arises from improper neutralization of input in the 'configurablePrefix' block attribute, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 6.1.4. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable block attribute. These scripts execute in the browsers of users who view the infected pages, potentially leading to theft of sensitive information or user session compromise. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if feasible. Monitor for updates from the vendor and apply patches promptly once available.