Essential Blocks Vulnerability – Page Builder Gutenberg Blocks, Patterns & Templates – Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2024-2255 |WordPress Plugin Vulnerability Report

Plugin Name: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates

Key Information:

  • Software Type: Plugin
  • Software Slug: essential-blocks
  • Software Status: Active
  • Software Author: wpdevteam
  • Software Downloads: 2,747,397
  • Active Installs: 100,000
  • Last Updated: March 19, 2024
  • Patched Versions: 4.5.4
  • Affected Versions: <= 4.5.2

Vulnerability Details:

  • Name: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2255
  • CVSS Score: 6.4
  • Publicly Published: March 19, 2024
  • Researcher: wesley
  • Description: The plugin is vulnerable to Stored Cross-Site Scripting via its widgets due to insufficient input sanitization and output escaping on user-supplied attributes such as listStyle. This allows authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages, which execute whenever a user accesses an injected page.


The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress has a vulnerability in versions up to and including 4.5.2 that allows for stored cross-site scripting through insufficient input sanitization and output escaping. This vulnerability has been patched in version 4.5.4.

Detailed Overview:

The vulnerability, identified by researcher Wesley, exists within the plugin's widgets and arises from inadequate sanitization of user inputs and escaping of outputs. This flaw enables authenticated users with at least contributor-level access to inject malicious scripts into web pages via the plugin. Such scripts can then be executed by unsuspecting users who view the compromised content. The risk posed by this vulnerability includes unauthorized access to user data and potential control over affected WordPress sites. Remediation has been addressed in the patched version 4.5.4 of the plugin.

Advice for Users:

  • Immediate Action: Users should update to the patched version 4.5.4 immediately.
  • Check for Signs of Vulnerability: Monitor your website for any unusual activity or unauthorized content additions.
  • Alternate Plugins: Consider using alternative plugins offering similar functionalities as a precaution.
  • Stay Updated: Regularly update all plugins to their latest versions to mitigate vulnerabilities.


The swift action by the plugin developers to release a patch for this vulnerability highlights the critical nature of maintaining updated software. To ensure the security of WordPress installations, users must upgrade to version 4.5.4 or later.


Detailed Report: 

In the digital ecosystem where websites serve as the cornerstone of business operations and customer engagement, the revelation of a security vulnerability can send ripples of concern across the online community. The recent identification of a significant security flaw in the Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress, known as CVE-2024-2255, brings to light the ever-present need for vigilance in cybersecurity practices. This plugin, a popular tool used by over 100,000 websites for enhancing page design and functionality, has been found susceptible to Authenticated Stored Cross-Site Scripting (XSS) attacks, posing a tangible risk to website integrity and user data security.

Essential Blocks – A Closer Look:

Essential Blocks for WordPress is renowned for its versatility in offering a wide array of Gutenberg blocks, patterns, and templates designed to streamline website design. Authored by wpdevteam, the plugin boasts a substantial download count of over 2.7 million, highlighting its popularity and widespread use within the WordPress community. Despite its impressive features, the plugin's vulnerability underscores the delicate balance between functionality and security in the digital domain.

Understanding CVE-2024-2255:

CVE-2024-2255 is classified under the CVSS:3.1 framework, with a score of 6.4, indicating a substantial security risk. The vulnerability arises from inadequate input sanitization and output escaping mechanisms within the plugin's widgets, allowing attackers with contributor-level access or higher to inject malicious scripts. These scripts can execute unauthorized actions, compromising the website's integrity and the security of its users' data.

Risks and Potential Impacts:

The exploitation of this vulnerability could lead to unauthorized data access, manipulation of website content, and potentially full control over the compromised website. The risk is not limited to the affected website alone but extends to its users, whose personal and sensitive information could be jeopardized.

Remediation and Proactive Measures:

The developers of Essential Blocks have promptly addressed this vulnerability by releasing a patched version, 4.5.4, effectively closing the security gap. Website owners and administrators are urged to update the plugin immediately to this secured version. Additionally, regular monitoring for unusual website activity and content alterations can serve as an early warning system for potential compromises.

A Look at the Past:

This is not the plugin's first encounter with security vulnerabilities; there have been 13 recorded instances since January 20, 2023. This history serves as a critical reminder of the dynamic nature of cybersecurity threats and the importance of maintaining an up-to-date and vigilant security posture.

For small business owners juggling myriad responsibilities, staying abreast of every security update and potential vulnerability can seem daunting. However, the repercussions of a compromised website - from data breaches to reputational damage - can far outweigh the effort required to maintain a secure online presence. Leveraging managed WordPress hosting services, automated security solutions, and professional cybersecurity assistance can alleviate the burden, ensuring that your website remains a safe and trusted platform for your customers.

In conclusion, the discovery of CVE-2024-2255 in the Essential Blocks plugin is a stark reminder of the relentless nature of cybersecurity threats. The digital landscape demands constant vigilance and a proactive approach to security. For small business owners, the key to safeguarding your online presence lies in prioritizing regular updates, employing robust security measures, and seeking professional guidance when necessary. In doing so, you not only protect your digital assets but also uphold the trust and confidence of your valued customers.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Essential Blocks Vulnerability – Page Builder Gutenberg Blocks, Patterns & Templates – Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2024-2255 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment