CVE-2026-96256

Name of the Vulnerable Software and Affected Versions Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns versions prior to 6.4.6

Description Stored Cross-Site Scripting (XSS) occurs via the 'marker' attribute of the Google Map block. The issue stems from insufficient input sanitization and output escaping of marker title and content values. These values are stored as JSON and subsequently decoded and concatenated directly into raw HTML by the frontend script's InfoWindow content builder. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns to version 6.4.6 or later.