CVE-2026-6740

Name of the Vulnerable Software and Affected Versions Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder versions prior to 4.7.5

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the commentIcon parameter, which execute when a user accesses the affected page.

Recommendations Update Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder to version 4.7.5 or later. As a temporary mitigation, restrict access to the commentIcon parameter for users with contributor-level permissions.