EUVD-2026-65279
GHSA-548f-rjq8-x8r3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor access (PR:L) required; victim must view or preview the page (UI:R, diverging from vendor UI:N); scope changed as payload executes in victim's privileged browser session.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious titleTag value survives wp_kses_post on save because it is stored inside a block-comment delimiter and the live HTML is only synthesized at render time by do_blocks(), meaning the payload also fires in administrator and editor sessions during post preview.
AnalysisAI
Stored Cross-Site Scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions through 4.0.2) permits authenticated contributors to persist arbitrary JavaScript via the titleTag block attribute. The vulnerability is architecturally subtle: the malicious payload bypasses WordPress's wp_kses_post sanitization at save time by residing inside a Gutenberg block-comment delimiter, and the dangerous HTML is only synthesized when do_blocks() renders the page, at which point no further escaping is applied. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold a WordPress account with contributor-level access or above on the target site - unauthenticated exploitation is not possible given PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects the changed-scope impact (the payload executes in victims' browser sessions), but the UI:N assignment warrants scrutiny: stored XSS payloads generally require a victim to navigate to or preview the injected page, which more accurately maps to UI:R under CVSS 3.1 guidance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available via WordPress plugin Trac changeset 3662715 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3662715%40gutenverse&new=3662715%40gutenverse); the exact released patched version number is not independently confirmed from the provided data, so administrators should update Gutenverse to the latest available version from the WordPress plugin repository and verify it is numbered above 4.0.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the Gutenverse FSE blocks plugin for WordPress (all versions through 4.0.2) enables authe
Stored Cross-Site Scripting in the Gutenverse WordPress Blocks, Page Builder & Site Editor plugin (all versions through
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today