Gutenverse WordPress Blocks CVE-2026-3002

Exploitation requires an authenticated WordPress user account with at minimum Contributor-level role on the target site - this is confirmed by the CVSS vector PR:L (low privileges). The Gutenverse plugin must be installed and active. The attacker must have the ability to create or edit posts and pages using the Gutenberg/FSE block editor. The payload persists across page loads, meaning the attacker does not need to be online at the time a victim views the page. Limiting factors: attackers cannot exploit this without valid WordPress credentials at Contributor level or above; sites that restrict contributor registration, enforce strong credential hygiene, or use multi-factor authentication substantially reduce the attack surface. The vulnerability does not affect sites running Gutenverse 4.0.3 or later (once patched).

The CVSS 3.1 base score of 6.4 (Medium) reflects a realistic but bounded threat: network-accessible (AV:N), low complexity (AC:L), low-privilege requirement (PR:L - Contributor role), and scope change (S:C), but with only partial confidentiality and integrity impact (C:L/I:L) and no availability impact. The scope change is the critical amplifying factor, as stored XSS can escalate to full admin account takeover if an administrator visits an injected page. No EPSS score was provided in the source intelligence, and the CVE is not listed in the CISA KEV catalog, meaning active exploitation in the wild is not confirmed at time of analysis. No dedicated public proof-of-concept exploit code has been identified beyond the Wordfence advisory, though the low technical barrier - a contributor simply pastes a crafted attribute value into a block - means exploitation is within reach of any attacker who can register or compromise a low-privilege account. For WordPress deployments that open contributor registration publicly or have a large editorial team, even a site managed by a mid-sized operational team should treat this as a meaningful remediation priority rather than a deferred medium-severity item, given the admin-takeover escalation path. The SSVC signals suggest limited automatable mass exploitation but a real targeted risk for sites with untrusted contributors.

An attacker who holds or acquires a Contributor-level WordPress account on the target site edits or creates a post, inserts a Gutenverse block (such as Animated Text, Team, or Chart), and injects a malicious JavaScript payload into a vulnerable block attribute field. The payload is stored in the WordPress database and rendered without escaping on every page view; when a site administrator visits the page, the script executes in their elevated browser session, potentially capturing session cookies or silently creating a rogue admin account. No dedicated exploit tooling is required beyond a browser and contributor credentials.