What is the CVSS score of EUVD-2026-18967?

EUVD-2026-18967 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2026-18967

| CVE-2026-2924 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-04 Wordfence

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 03:30 euvd

EUVD-2026-18967

Analysis Generated

Apr 04, 2026 - 03:30 vuln.today

CVE Published

Apr 04, 2026 - 02:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Gutenverse - Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageLoad' parameter in versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Gutenverse - Ultimate WordPress FSE Blocks Addons & Ecosystem plugin versions up to 3.4.6 allows authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript via the 'imageLoad' parameter, resulting in persistent script execution in pages viewed by other users. CVSS 6.4 reflects medium severity with cross-site scope; no public exploit code or active exploitation has been identified at the time of analysis, but the vulnerability requires only low privileges and no user interaction beyond initial page access.

Technical ContextAI

Gutenverse is a WordPress block editor addon plugin that extends FSE (Full Site Editing) functionality. The vulnerability exists in the processing of the 'imageLoad' parameter, which appears to be a configuration option for image handling within block elements. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to sanitize user input on the parameter and to properly escape output when the value is rendered in page markup. Authenticated WordPress users with contributor role or above are able to craft malicious input that bypasses sanitization, allowing stored XSS payload injection. The stored nature means the script persists in the WordPress database and executes in the context of any user who visits the affected page, potentially compromising session tokens, CSRF protection, or performing actions on behalf of site visitors.

RemediationAI

Update the Gutenverse plugin to version 3.4.7 or later via the WordPress admin dashboard (Plugins > Installed Plugins > Gutenverse > Update Now) or through the plugin repository. The patch adds proper input sanitization for the 'imageLoad' parameter and output escaping on rendering. If automatic updates are disabled, manually download the latest version from https://plugins.trac.wordpress.org/changeset/3468383/gutenverse or the official plugin page at https://wordpress.org/plugins/gutenverse/. For sites unable to update immediately, restrict contributor-level access to trusted users only via WordPress user role management (Users > Permissions) and monitor admin audit logs for suspicious block creation or modification activity. No temporary workaround that disables the vulnerable feature is available; patching is the primary remediation.