What is the CVSS score of CVE-2026-3001?

CVE-2026-3001 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Gutenverse WordPress Plugin CVE-2026-3001

EUVD-2026-32114 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-ch38-8ggq-4hxr

XSS PHP WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:32 vuln.today

CVE Published

May 27, 2026 - 08:16 nvd

MEDIUM 6.1

DescriptionCVE.org

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. Specifically, the render_content() method in class-search-result-title.php outputs the value of get_query_var('s') directly into the page HTML without applying esc_html() or any other escaping function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a crafted URL that execute if a user clicks the link, provided the gutenverse/search-result-title block is present on the site's search results template.

AnalysisAI

Reflected Cross-Site Scripting in the Gutenverse plugin for WordPress (all versions through 3.4.6) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious search URL. The vulnerability arises from the plugin's search-result-title block outputting the raw search query string directly into page HTML without sanitization. Exploitation requires user interaction (victim must click a crafted link) and the gutenverse/search-result-title block must be present on the site's search results template. No public exploit code has been identified at time of analysis, and CISA KEV confirmation of active exploitation is absent.

Technical ContextAI

The vulnerability exists in the Gutenverse WordPress plugin (PHP), specifically in the render_content() method within includes/block/class-search-result-title.php at line 29. The method calls WordPress's get_query_var('s') - which retrieves the current search query string from the URL - and writes it directly into rendered page HTML without passing it through WordPress's standard output-escaping function esc_html() or any equivalent sanitization. This violates WordPress's secure coding standards for block rendering. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class; reflected XSS specifically means the payload travels in the HTTP request and is reflected back in the response without being stored. The Scope:Changed (S:C) in the CVSS vector confirms the injected script can affect resources beyond the vulnerable component itself - i.e., it can operate in the victim's full browser session context across the WordPress origin.

RemediationAI

A code-level fix has been committed upstream as documented in WordPress Plugin Trac changeset 3468383 (https://plugins.trac.wordpress.org/changeset/3468383/), which addresses the missing esc_html() call. The exact released patched version number is not independently confirmed in the available input data - site owners should update to the latest available version of Gutenverse via the WordPress admin dashboard and verify the installed version exceeds 3.4.6. Additional guidance is available from the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/23518a21-7b76-4edb-9a35-b6f623ed50a7. As a compensating control prior to patching, administrators can remove the gutenverse/search-result-title block from all search results page templates; this eliminates the vulnerable code path entirely but requires rebuilding search results templates with an alternative block. Wordfence's firewall rules (for premium subscribers) may also provide virtual patching as a short-term measure.