Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 31 vulnerability records associated with Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns, published between 2023 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

31Total records
1Critical
3High
27Medium
0Low
0Informational
31Patched records
0Currently marked unpatched
2023-01-20First disclosure
2026-06-24Latest disclosure
31 of 31CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
20231111 records
202499 records
202588 records
202633 records

Severity Breakdown

SeverityRecordsShare
Critical13.2%
High39.7%
Medium2787.1%

Vulnerability-Type Breakdown

Cross-Site Scripting

15 records48.4%

First: 2024. Latest: 2026.

Missing Authorization

10 records32.3%

First: 2023. Latest: 2025.

Other

4 records12.9%

First: 2023. Latest: 2026.

CSRF

1 record3.2%

First: 2023. Latest: 2023.

Path Traversal

1 record3.2%

First: 2023. Latest: 2023.

Patch Status

Patched
31
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 6.2.0
  • 6.1.4
  • 6.1.0
  • 5.7.3
  • 5.7.2
  • 5.4.1
  • 5.3.2
  • 5.3.0
  • 4.8.4
  • 5.1.1
  • 4.9.0
  • 4.7.0
  • 4.5.13
  • 4.5.10
  • 4.5.4
  • 4.4.10
  • 4.5.2
  • 4.4.7
  • 4.4.3
  • 4.2.1
  • 4.0.7
  • 3.8.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-6.1.4Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block AttributeJune 24, 20266.2.0Medium
*-6.1.3Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request ForgeryJune 4, 20266.1.4High
*-6.0.4Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesMay 1, 20266.1.0Medium
*-5.7.2Essential Blocks <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information DisclosureDecember 16, 20255.7.3Medium
*-5.7.1Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request ForgeryOctober 17, 20255.7.2Medium
*-5.7.1Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingOctober 17, 20255.7.2Medium
*-5.4.0Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel WidgetsMay 26, 20255.4.1Medium
*-5.3.1Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingMarch 7, 20255.3.2Medium
*-5.2.3Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingFebruary 25, 20255.3.0Medium
*-4.8.3Essential Blocks for Gutenberg <= 4.8.3 - Missing AuthorizationFebruary 22, 20254.8.4Medium
*-5.1.0Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site ScriptingJanuary 7, 20255.1.1Medium
*-4.8.4Essential Blocks for Gutenberg <= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingSeptember 30, 20244.9.0Medium
*-4.6.1Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingJuly 12, 20244.7.0Medium
*-4.5.12Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingMay 16, 20244.5.13Medium
*-4.5.9Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.9 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting via "Social Icons" BlockApril 18, 20244.5.10Medium
*-4.5.3Essential Blocks for Gutenberg <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingApril 5, 20244.5.4Medium
*-4.4.9Essential Blocks for Gutenberg <= 4.4.9 - Missing AuthorizationMarch 28, 20244.4.10Medium
*-4.5.3Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingMarch 19, 20244.5.4Medium
*-4.5.1Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingFebruary 28, 20244.5.2Medium
*-4.4.6Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingJanuary 9, 20244.4.7Medium
*-4.2.0Essential Blocks for Gutenberg <= 4.2.0 - Incorrect Authorization ChecksDecember 26, 20234.2.1Medium
*-4.4.2Essential Blocks <= 4.4.2 - Unauthenticated Local File InclusionDecember 21, 20234.4.3Critical
*-4.2.0Essential Blocks for Gutenberg <= 4.2.0 - Missing Authorization via AJAX actionsNovember 13, 20234.2.1Medium
*-4.2.0Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queriesSeptember 13, 20234.2.1High
*-4.2.0Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via productsSeptember 13, 20234.2.1High

Selected source records

Latest Records

MediumCVE-2026-10833

Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute

Published: June 24, 2026

Affected versions
*-6.1.4
Patched versions
6.2.0
Original Wordfence record
HighCVE-2026-10586

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery

Published: June 4, 2026

Affected versions
*-6.1.3
Patched versions
6.1.4
Original Wordfence record
MediumCVE-2026-4658

Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes

Published: May 1, 2026

Affected versions
*-6.0.4
Patched versions
6.1.0
Original Wordfence record
MediumCVE-2025-11369

Essential Blocks <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information Disclosure

Published: December 16, 2025

Affected versions
*-5.7.2
Patched versions
5.7.3
Original Wordfence record
MediumCVE-2025-11361

Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery

Published: October 17, 2025

Affected versions
*-5.7.1
Patched versions
5.7.2
Original Wordfence record
MediumCVE-2025-11270

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 17, 2025

Affected versions
*-5.7.1
Patched versions
5.7.2
Original Wordfence record
MediumCVE-2025-4682

Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets

Published: May 26, 2025

Affected versions
*-5.4.0
Patched versions
5.4.1
Original Wordfence record
MediumCVE-2025-1664

Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 7, 2025

Affected versions
*-5.3.1
Patched versions
5.3.2
Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-6623

Essential Blocks <= 4.4.2 - Unauthenticated Local File Inclusion

Published: December 21, 2023

Affected versions
*-4.4.2
Patched versions
4.4.3
Original Wordfence record
HighCVE-2023-4402

Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products

Published: September 13, 2023

Affected versions
*-1.1.0
Patched versions
1.1.1
Affected versions
*-4.2.0
Patched versions
4.2.1
Original Wordfence record
HighCVE-2023-4386

Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries

Published: September 13, 2023

Affected versions
*-1.1.0
Patched versions
1.1.1
Affected versions
*-4.2.0
Patched versions
4.2.1
Original Wordfence record
HighCVE-2026-10586

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery

Published: June 4, 2026

Affected versions
*-6.1.3
Patched versions
6.1.4
Original Wordfence record
MediumCVE-2026-10833

Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute

Published: June 24, 2026

Affected versions
*-6.1.4
Patched versions
6.2.0
Original Wordfence record
MediumCVE-2024-47385

Essential Blocks for Gutenberg <= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 30, 2024

Affected versions
*-4.8.4
Patched versions
4.9.0
Original Wordfence record
MediumCVE-2026-4658

Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes

Published: May 1, 2026

Affected versions
*-6.0.4
Patched versions
6.1.0
Original Wordfence record
MediumCVE-2025-1664

Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: March 7, 2025

Affected versions
*-5.3.1
Patched versions
5.3.2
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory