Gutenverse WordPress Plugin CVE-2026-19943

Attacker must hold a WordPress account with contributor-level access or above on the target site - unauthenticated exploitation is not possible given PR:L in the CVSS vector. The Gutenverse plugin must be installed and active. Exploitation specifically targets the titleTag block attribute of Gutenverse blocks, as implemented in the Chart block (class-chart.php); the payload must be encoded or structured to survive wp_kses_post at save time by residing within a Gutenberg block-comment delimiter. A victim with administrator or editor privileges must subsequently view or preview the injected post for the XSS to execute in a privileged session context. Exploitation is limited by: (1) the requirement for a valid contributor or higher account, (2) the need for victim navigation to the injected page, and (3) the Gutenverse plugin being installed - sites not using Gutenverse are unaffected.

The NVD-assigned CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects the changed-scope impact (the payload executes in victims' browser sessions), but the UI:N assignment warrants scrutiny: stored XSS payloads generally require a victim to navigate to or preview the injected page, which more accurately maps to UI:R under CVSS 3.1 guidance. If scored with UI:R, the base score drops to approximately 5.4 Medium. The S:C metric is well-justified because the XSS context is the victim's authenticated administrator session, not only the page origin. No EPSS data was provided in the intelligence package; without it, exploitation probability cannot be quantitatively assessed. The vulnerability is not listed in CISA KEV and no public POC is confirmed, indicating it has not been widely weaponized at time of analysis. Despite the moderate CVSS, the practical risk is elevated on multi-contributor WordPress installations because contributor-level accounts are commonly granted to content authors, guest bloggers, and editors-in-training - a realistic attacker population. The admin-session impact during preview makes this a viable privilege-escalation vector.

An attacker registers a WordPress account with contributor-level access (or compromises an existing contributor account) and creates a new post that includes a Gutenverse Chart block, setting the titleTag attribute to a JavaScript payload encoded to survive wp_kses_post serialization inside the block comment delimiter. When a site administrator or editor opens the post for review or clicks the preview button, do_blocks() renders the injected titleTag into live HTML and the payload executes in the administrator's authenticated browser session, enabling session cookie theft, unauthorized admin actions, or further site compromise. No public proof-of-concept exploit has been confirmed at time of analysis, but the bypass technique is described in sufficient detail in the CVE to be independently reproduced.