Plugin icon

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns

essential-blocks

Vulnerabilities:

26

Last Updated:

May 13, 2026

Active Installs:

200000

Published
Title
Fixed in
CVSS
Published
2026-05-01
Title
Gutenberg Essential Blocks < 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
Fixed in
Fixed in 6.1.0
CVSS
5.5 (medium)
Published
2025-12-16
Title
Essential Blocks < 5.7.3 - Missing Authorization To Authenticated (Author+) Information Disclosure
Fixed in
Fixed in 5.7.3
CVSS
4.3 (medium)
Published
2025-10-17
Title
Essential Blocks < 5.7.2 - Authenticated (Author+) Server-Side Request Forgery
Fixed in
Fixed in 5.7.2
CVSS
6.4 (medium)
Published
2025-10-17
Title
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns < 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.7.2
CVSS
6.4 (medium)
Published
2025-05-26
Title
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates < 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets
Fixed in
Fixed in 5.4.1
CVSS
6.4 (medium)
Published
2025-03-07
Title
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates < 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.3.2
CVSS
6.4 (medium)
Published
2025-02-25
Title
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates < 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.3.0
CVSS
6.4 (medium)
Published
2025-02-22
Title
Essential Blocks for Gutenberg < 4.8.4 - Missing Authorization
Fixed in
Fixed in 4.8.4
CVSS
4.3 (medium)
Published
2025-01-07
Title
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates < 5.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.1.1
CVSS
4.4 (medium)
Published
2024-09-30
Title
Essential Blocks for Gutenberg < 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.9.0
CVSS
6.4 (medium)
Published
2024-07-12
Title
Essential Blocks < 4.7.0 - Contributor+ Stored XSS
Fixed in
Fixed in 4.7.0
CVSS
5.9 (medium)
Published
2024-05-16
Title
Essential Blocks < 4.5.13 - Contributor+ Stored XSS
Fixed in
Fixed in 4.5.13
CVSS
5.9 (medium)
Published
2024-04-18
Title
Essential Blocks < 4.5.10 - Contributor+ DOM-Based XSS via Social Icons Block
Fixed in
Fixed in 4.5.10
CVSS
5.9 (medium)
Published
2024-04-05
Title
Essential Blocks for Gutenberg < 4.5.4 - Contributor+ Stored Cross-Site Scripting
Fixed in
Fixed in 4.5.4
CVSS
6.4 (medium)
Published
2024-03-28
Title
Essential Blocks for Gutenberg < 4.4.10 - Missing Authorization
Fixed in
Fixed in 4.4.10
CVSS
4.3 (medium)
Published
2024-03-19
Title
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates < 4.5.4 - Contributor+ Stored XSS
Fixed in
Fixed in 4.5.4
CVSS
6.4 (medium)
Published
2024-02-28
Title
Essential Blocks < 4.5.2 - Contributor+ Stored XSS
Fixed in
Fixed in 4.5.2
CVSS
5.9 (medium)
Published
2024-01-09
Title
Essential Blocks < 4.4.7 - Contributor+ Stored Cross-Site Scripting
Fixed in
Fixed in 4.4.7
CVSS
6.8 (medium)
Published
2023-12-26
Title
Essential Blocks for Gutenberg < 4.2.1 - Subscriber+ Unauthorised Actions
Fixed in
Fixed in 4.2.1
CVSS
5.4 (medium)
Published
2023-12-26
Title
Essential Blocks for Gutenberg < 4.2.1 - Contributor+ Unauthorised Actions
Fixed in
Fixed in 4.2.1
CVSS
3.8 (low)
Published
2023-12-21
Title
Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 4.4.3
CVSS
9.0 (critical)
Published
2023-11-13
Title
Essential Blocks for Gutenberg < 4.2.1 - Missing Authorization via AJAX actions
Fixed in
Fixed in 4.2.1
CVSS
4.3 (medium)
Published
2023-09-19
Title
Essential Blocks < 4.2.1 - Unauthenticated Object Injection
Fixed in
Fixed in 4.2.1
CVSS
8.1 (high)
Published
2023-09-13
Title
Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries
Fixed in
Fixed in 4.2.1
CVSS
8.1 (high)
Published
2023-09-13
Title
Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products
Fixed in
Fixed in 4.2.1
CVSS
8.1 (high)
Published
2023-04-18
Title
Essential Blocks < 4.0.7 - Multiple Functions Missing Authorization Checks
Fixed in
Fixed in 4.0.7
CVSS
4.3 (medium)