CVE-2026-96256 wpdevteam CVE debrief

Who should care

WordPress administrators and users with Contributor-level access and above should assess exposure and prioritize remediation. This includes reviewing affected product deployments, planning vendor-supported updates or mitigations, and implementing compensating controls for exposed systems.

Why it matters

CVE-2026-96256 is a Stored Cross-Site Scripting vulnerability in the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress. It allows authenticated attackers to inject arbitrary web scripts, potentially leading to XSS attacks. WordPress administrators and users with Contributor-level access and above should assess exposure and prioritize remediation.

• Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
• Potential for Cross-Site Scripting (XSS) attacks
• Possible impact on user interactions with injected pages

Technical summary

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5. This is due to insufficient input sanitization and output escaping on marker title/content values, which are stored as JSON and then decoded and concatenated directly into raw HTML by the frontend script's InfoWindow content builder.

Defensive priority

Medium-priority defensive actions are recommended to address this vulnerability.

Recommended defensive actions

• Update to a patched version of the plugin
• Review and sanitize user-input data
• Implement Content Security Policy (CSP) to mitigate XSS attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported by [email protected] and is attributed to insufficient input sanitization and output escaping on marker title/content values. The Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 of the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress stores marker title/content values as JSON, which are then decoded and concatenated directly into raw HTML by the frontend script's InfoWindow content builder. This allows for potential Cross-S

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.