CVE-2026-4801 is a stored cross-site scripting vulnerability in the Page Builder Gutenberg Blocks – CoBlocks WordPress plugin (versions up to 3.1.16). The flaw arises from insufficient output escaping of event titles, descriptions, and locations obtained from external iCal feeds in the Events block rendering function. Authenticated attackers with Contributor-level permissions or higher can inject arbitrary web scripts into pages, which execute when those pages are accessed by users. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity with no availability impact. No official fix or patch has been documented yet.

Successful exploitation allows authenticated users with Contributor-level access or above to inject and store malicious scripts via external iCal feed data. These scripts execute in the context of users viewing the compromised pages, potentially leading to partial confidentiality and integrity loss. There is no impact on availability. This could facilitate actions such as session hijacking or unauthorized actions within the affected site context. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling the Events block or external iCal feed functionality if feasible. Monitor for updates from the vendor and apply patches promptly once available.