What is the CVSS score of CVE-2026-2868?

CVE-2026-2868 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Gutenverse WordPress Plugin CVE-2026-2868

EUVD-2026-27171 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:31 vuln.today

DescriptionCVE.org

The Gutenverse - Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG' parameter in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Gutenverse - Ultimate WordPress FSE Blocks Addons & Ecosystem plugin up to version 3.5.3 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via the 'separatorIconSVG' parameter, executing malicious scripts whenever users view affected pages. The vulnerability stems from insufficient input sanitization and output escaping. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

Gutenverse is a WordPress Full Site Editing (FSE) block addon plugin that extends the Gutenberg editor with custom block components. The vulnerability exists in the handling of the 'separatorIconSVG' parameter, which accepts user-supplied SVG content. SVG elements can contain embedded JavaScript via event handlers (onclick, onerror, onload) and script tags. The plugin fails to sanitize this input before storing it in the database and fails to escape it on output, creating a Stored XSS condition (CWE-79: Improper Neutralization of Input During Web Page Generation). As an authenticated vulnerability requiring contributor-level permissions, the threat model assumes WordPress user accounts with publishing capabilities - a common role in multi-author sites, editorial teams, and SaaS WordPress hosting environments.

RemediationAI

Update Gutenverse to version 3.5.4 or later, which includes fixes for input sanitization and output escaping of the 'separatorIconSVG' parameter. Immediate mitigation for sites unable to patch immediately: restrict contributor-level plugin access by using WordPress role management to limit who can publish or edit pages containing Gutenverse blocks (reduce contributor role to author-only or limit to trusted admins). Review server access logs and page edit history via WordPress audit plugins to identify if any Stored XSS payloads were injected while the vulnerability was active. Scan published pages for suspicious script tags or SVG event handlers in page source. As a temporary compensating control, disable the Gutenverse plugin entirely until patched, though this will deactivate all Gutenverse blocks on the site. Monitor WordPress plugin security advisories from Wordfence for additional vulnerability data.