Stored Cross-Site Scripting Vulnerability in Gutenberg Essential Blocks Plugin by WordPress

CVE-2026-96256

What is CVE-2026-96256?

The Gutenberg Essential Blocks plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping of the ‘marker’ attribute within the Google Map block. When a user enters content into this field, it is stored as JSON and subsequently decoded and rendered in raw HTML by the frontend script, specifically during the InfoWindow content assembly. Authenticated attackers, with Contributor-level access and higher, can exploit this vulnerability to inject malicious web scripts into the pages, which will execute when other users access the compromised content.

References