CVE-2026-4658 is a stored cross-site scripting vulnerability in the WordPress plugin 'Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns' affecting all versions up to 6.0.4. The vulnerability occurs because the render_callback() function inserts the className, classHook, and blockId attributes into inner div elements using raw sprintf() and implode() without proper escaping (esc_attr()). Although the outer wrapper div is properly escaped, the inner divs are not, enabling authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript code that executes when the page is viewed.

An attacker with Contributor-level or higher privileges can inject malicious scripts into pages via vulnerable attributes in the Add to Cart block. These scripts execute in the context of users viewing the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or remediation guidance has been provided by the vendor. Until a patch is available, restrict Contributor-level access to trusted users only and consider removing or disabling the vulnerable Add to Cart block if feasible. Monitor the vendor's advisory channels for updates and apply official patches once released.