Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-96256 · Microsoft / collected KEV context

cve-program · CVE-2026-96256

• https://www.wordfence.com/threat-intel/vulnerabilities/id/606f25d9-f8c7-416a-8bb8-0cc57901ff5a?source=cve
• https://plugins.trac.wordpress.org/browser/essential-blocks/tags/6.4.5/assets/blocks/google-map/frontend.js#L1
• https://plugins.trac.wordpress.org/browser/essential-blocks/tags/6.4.5/includes/Blocks/GoogleMap.php#L82
• https://plugins.trac.wordpress.org/browser/essential-blocks/tags/6.4.5/src/blocks/google-map/src/save.js#L35
• https://plugins.trac.wordpress.org/browser/essential-blocks/tags/6.3.0/assets/blocks/google-map/frontend.js#L1
• https://plugins.trac.wordpress.org/browser/essential-blocks/tags/6.3.0/includes/Blocks/GoogleMap.php#L82
• https://plugins.trac.wordpress.org/browser/essential-blocks/tags/6.3.0/src/blocks/google-map/src/save.js#L35
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3715353%40essential-blocks%2Ftags%2F6.4.6&old=3706819%40essential-blocks%2Ftags%2F6.4.5
• https://plugins.trac.wordpress.org/changeset/3715353/essential-blocks/trunk/assets/blocks/google-map/frontend.js

No related operational record is retained in the current change model.