EUVD-2026-24716
GHSA-gw9v-4w4q-22c9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Gutentools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Slider block's block_id attribute in all versions up to, and including, 1.1.3. This is due to insufficient input sanitization and output escaping combined with a custom unescaping routine that reintroduces dangerous characters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Gutentools WordPress plugin (versions up to 1.1.3) allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages via the Post Slider block's block_id attribute. The vulnerability exploits insufficient input sanitization combined with a custom unescaping routine that reintroduces dangerous characters, enabling persistent payload execution whenever users access injected pages. This affects all installations using the plugin at or below version 1.1.3 and requires only low-privileged WordPress authentication.
Technical ContextAI
The Gutentools plugin implements custom Gutenberg blocks for WordPress, including a Post Slider block that accepts a block_id attribute. The vulnerability stems from a two-stage sanitization failure: the plugin insufficiently sanitizes the block_id input on storage, then applies a custom unescaping routine during output rendering that reintroduces HTML/JavaScript characters that should remain escaped. This violates standard WordPress security practices which rely on proper use of functions like wp_kses_post() and esc_attr(). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-controlled input flows into page output without proper encoding. The Wordfence and plugin repository code references at lines 232 (post-slider.php) and 123 (gutentools_block.php) indicate the flawed sanitization and output rendering logic affecting the block rendering pipeline.
RemediationAI
Upgrade the Gutentools plugin to version 1.1.4 or later, which includes fixes to the Post Slider block's sanitization and output escaping routines. Site administrators should immediately audit all existing pages and posts using the Post Slider block for suspicious or unauthorized block_id attribute values, particularly those containing HTML/JavaScript syntax, and revert or delete any compromised content. WordPress sites must restrict Contributor-level role assignments to trusted users only, and enforce code review processes for block-containing content before publication. For sites unable to upgrade immediately, disable the Post Slider block entirely via a custom mu-plugin that filters out post-slider blocks during rendering, though this will remove block functionality for all pages until the plugin is patched. The WordPress plugin repository changeset 3476597 references the committed fix; verify that your installed version reflects the post-1.1.3 code before assuming remediation is complete.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today