#WordPress, make sure you only use block patterns from people you trust, just like plugins and themes. A block pattern could contain javascript code, and be executed as “you” (with your admin credentials) when you view the page where it was used. This would be an XSS attack.