CVE-2026-10833

MediumCVSS 6.4/10Last modified Jun 25, 2026

Description

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'configurablePrefix' Block Attribute in all versions up to, and including, 6.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
wpdevteam	Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns	<= 6.1.4

References

Timeline

Published: Jun 25, 2026
Last modified: Jun 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1083303.6Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.CVE-2026-1083313.3Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.CVE-2026-1083326.3Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.CVE-2026-1083332.5Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.CVE-2026-1083347.4A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines wh CVE-2026-1083359.1When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attac CVE-2026-1083369.1When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate fo CVE-2026-1083377.4An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in CVE-2026-108338Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenti CVE-2026-108344.6The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before movin CVE-2026-108357.7The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions CVE-2026-1083578.8PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored