Essential Blocks < 6.4.0 - Information Disclosure

Gutenberg Essential Blocks WordPress plugin 6.4.0 contains an information disclosure caused by unrestricted access to a public REST route exposing non-public WooCommerce sales metrics, letting unauthenticated users read product sales data. id: CVE-2026-13153 info: name: Essential Blocks 6.4.0 -...

Essential Blocks < 4.4.3 - Local File Inclusion

Wordpress Essential Blocks plugin prior to 4.4.3 was discovered to be vulnerable to a significant Local File Inclusion vulnerability that may be exploited by any attacker, regardless of whether they have an account on the site. id: CVE-2023-6623 info: name: Essential Blocks 4.4.3 - Local File...

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion El plugin no impide que atacantes no autenticados sobrescriban variables locales al renderizar plantillas a través de la API REST, lo que puede conducir a ataques de inclusión local de archivos Local File Inclusion. Uso: usage: PoC.py ...

CVE-2026-96256

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

EUVD-2026-90594

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

CVE-2026-96256

The Gutenberg Essential Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 6.4.5 . The flaw resides in the Google Map block's 'marker' attribute due to inadequate input sanitization and output escaping of marker title and content values....

CVE-2026-96256 Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

WordPress Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Essential Blocks for Gutenberg versions = 6.4.5...

WordPress Essential Blocks plugin < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint vulnerability

Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Essential Blocks for Gutenberg versions 6.4.0...

WordPress Essential Blocks plugin < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint vulnerability

Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Essential Blocks for Gutenberg versions 6.4.0...

CVE-2026-13154

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

CVE-2026-13153

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published...

CVE-2026-13153 Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published...

CVE-2026-13154

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

EUVD-2026-53735

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published...

CVE-2026-13153

The Gutenberg Essential Blocks WordPress plugin (versions before 6.4.0 ) is vulnerable to an information disclosure flaw. The issue stems from unrestricted access to a public REST route that over-fetches non-public WooCommerce per-product sales metrics. This allows unauthenticated users to read t...

CVE-2026-13154 Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

CVE-2026-13153

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published...

CVE-2026-13154 Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

CVE-2026-13154

The Gutenberg Essential Blocks WordPress plugin (versions before 6.4.0 ) is vulnerable to unauthenticated content disclosure. The root cause is a failure to verify if an attacker-supplied post type is publicly viewable before querying it within one of its public REST routes . This allows unauthen...