WordPress essential-blocks has 17 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-6623 | The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when renderin | critical | 9.8 | <4.4.3 | 4.4.3 |
| CVE-2023-4402 | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization | high | 8.1 | <4.2.1 | 4.2.1 |
| CVE-2023-4386 | The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization | high | 8.1 | <=4.2.0 | – |
| CVE-2023-2085 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templa | medium | 4.3 | <=4.0.6 | – |
| CVE-2023-2086 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templa | medium | 4.3 | <=4.0.6 | – |
| CVE-2023-2083 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save f | medium | 4.3 | <=4.0.6 | – |
| CVE-2024-2255 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | <4.5.3 | 4.5.3 |
| CVE-2023-2084 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the get fu | medium | 4.3 | <=4.0.6 | – |
| CVE-2024-13803 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | <=5.2.3 | – |
| CVE-2024-4891 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | <4.5.13 | 4.5.13 |
| CVE-2024-5595 | The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a | medium | 5.4 | <4.7.0 | 4.7.0 |
| CVE-2024-1854 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | <4.5.2 | 4.5.2 |
| CVE-2023-7071 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | <=4.4.6 | – |
| CVE-2024-3818 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 5.4 | <4.5.10 | 4.5.10 |
| CVE-2023-2087 | The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due t | medium | 4.3 | <=4.0.6 | – |
| CVE-2024-12045 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 4.4 | <=5.0.9 | – |
| CVE-2025-1664 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting | medium | 6.4 | <5.3.2 | 5.3.2 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked