CVE-2026-4658 Overview
CVE-2026-4658 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress. The flaw affects all versions up to and including 6.0.4. It resides in the Add to Cart block (essential-blocks/add-to-cart), where the className, classHook, and blockId attributes are written into HTML attributes without proper escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes when users render the affected page [CWE-79].
Critical Impact
Authenticated contributors can inject persistent JavaScript that runs in the browser of any visitor or administrator who views the page, enabling session theft, privilege escalation through admin actions, and content modification.
Affected Products
- Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress
- All versions up to and including 6.0.4
- Fixed in version 6.1.0
Discovery Timeline
- 2026-05-02 - CVE-2026-4658 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-4658
Vulnerability Analysis
The vulnerability resides in the render_callback() function of the Add to Cart block within includes/Blocks/AddToCart.php. The plugin reads three block attributes—className, classHook, and blockId—and inserts them into rendered HTML using sprintf() and implode() without applying esc_attr() to the user-controlled values.
While the outer wrapper div uses get_block_wrapper_attributes(), which performs proper escaping, the inner div elements bypass this protection. Attacker-supplied content is written directly into class and data-id attributes. A contributor saving a post that contains the Add to Cart block can break out of the attribute context and inject script payloads that execute on page render.
Root Cause
The root cause is missing output escaping on attacker-controlled block attributes during server-side rendering. Block editor attributes flow from the post editor into PHP render callbacks as untrusted strings. The Add to Cart block treats these strings as safe and concatenates them directly into HTML attribute values, violating WordPress contextual escaping requirements for class and data-* attributes.
Attack Vector
Exploitation requires a WordPress account with Contributor privileges or higher on the target site. The attacker creates or edits a post containing the Add to Cart block and supplies a malicious payload in the className, classHook, or blockId attribute. The payload closes the surrounding HTML attribute and injects script content. When an editor, administrator, or site visitor views the rendered page, the script runs in their session context.
Referenced source lines are documented in the WordPress Essential Blocks AddToCart.php source and the vendor changeset for version 6.1.0.
Detection Methods for CVE-2026-4658
Indicators of Compromise
- Stored post or block content containing quote-breaking sequences in className, classHook, or blockId attributes of the essential-blocks/add-to-cart block.
- Unexpected <script>, onerror, onload, or onmouseover substrings inside wp_posts.post_content rows referencing the Add to Cart block.
- Outbound requests from administrative browser sessions to unfamiliar domains shortly after a contributor saves a post.
Detection Strategies
- Search the database for the block delimiter wp:essential-blocks/add-to-cart and inspect the JSON attribute payload for HTML metacharacters such as ", <, and >.
- Review WordPress audit logs for posts created or edited by Contributor-level accounts that include the Add to Cart block.
- Inspect rendered HTML for class or data-id attributes that contain script tags or event handler names rather than valid CSS class tokens.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to track post revisions by low-privilege roles.
- Forward web server access logs and WordPress logs to a centralized analytics platform to correlate suspicious post edits with anomalous administrator session activity.
- Apply a Content Security Policy that restricts inline scripts and unauthorized script sources to limit the impact of stored payloads.
How to Mitigate CVE-2026-4658
Immediate Actions Required
- Update the Essential Blocks plugin to version 6.1.0 or later on every WordPress site that has it installed.
- Audit all Contributor, Author, and Editor accounts and revoke access for unused or unverified users.
- Inspect existing posts that use the Add to Cart block and remove malicious payloads from the affected attributes.
Patch Information
The vendor remediated the issue in Essential Blocks version 6.1.0. The fix introduces proper escaping on the className, classHook, and blockId attributes inside the Add to Cart block render callback. Patch details are available in the WordPress.org changeset and the Wordfence advisory.
Workarounds
- Temporarily disable the Essential Blocks plugin until the update can be applied.
- Restrict Contributor and Author roles from inserting the Add to Cart block by limiting allowed blocks per role.
- Deploy a Web Application Firewall rule that blocks requests containing HTML metacharacters in Essential Blocks attribute payloads.
# Update Essential Blocks via WP-CLI to the patched release
wp plugin update essential-blocks --version=6.1.0
# Verify the installed version after upgrade
wp plugin get essential-blocks --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
