What is the CVSS score of CVE-2026-1395?

CVE-2026-1395 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Gutentools WordPress Plugin CVE-2026-1395

EUVD-2026-24716 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-gw9v-4w4q-22c9

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 13:09 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 10:00 euvd

EUVD-2026-24716

Analysis Generated

Apr 22, 2026 - 10:00 vuln.today

CVE Published

Apr 22, 2026 - 09:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Gutentools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Slider block's block_id attribute in all versions up to, and including, 1.1.3. This is due to insufficient input sanitization and output escaping combined with a custom unescaping routine that reintroduces dangerous characters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Gutentools WordPress plugin (versions up to 1.1.3) allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages via the Post Slider block's block_id attribute. The vulnerability exploits insufficient input sanitization combined with a custom unescaping routine that reintroduces dangerous characters, enabling persistent payload execution whenever users access injected pages. This affects all installations using the plugin at or below version 1.1.3 and requires only low-privileged WordPress authentication.

Technical ContextAI

The Gutentools plugin implements custom Gutenberg blocks for WordPress, including a Post Slider block that accepts a block_id attribute. The vulnerability stems from a two-stage sanitization failure: the plugin insufficiently sanitizes the block_id input on storage, then applies a custom unescaping routine during output rendering that reintroduces HTML/JavaScript characters that should remain escaped. This violates standard WordPress security practices which rely on proper use of functions like wp_kses_post() and esc_attr(). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-controlled input flows into page output without proper encoding. The Wordfence and plugin repository code references at lines 232 (post-slider.php) and 123 (gutentools_block.php) indicate the flawed sanitization and output rendering logic affecting the block rendering pipeline.

RemediationAI

Upgrade the Gutentools plugin to version 1.1.4 or later, which includes fixes to the Post Slider block's sanitization and output escaping routines. Site administrators should immediately audit all existing pages and posts using the Post Slider block for suspicious or unauthorized block_id attribute values, particularly those containing HTML/JavaScript syntax, and revert or delete any compromised content. WordPress sites must restrict Contributor-level role assignments to trusted users only, and enforce code review processes for block-containing content before publication. For sites unable to upgrade immediately, disable the Post Slider block entirely via a custom mu-plugin that filters out post-slider blocks during rendering, though this will remove block functionality for all pages until the plugin is patched. The WordPress plugin repository changeset 3476597 references the committed fix; verify that your installed version reflects the post-1.1.3 code before assuming remediation is complete.