Gutenverse EUVD-2026-86547

Requires an authenticated account with contributor-level capability or above on a WordPress site running Gutenverse <=4.0.8, and the attacker must be able to add/edit a Post Comment Block (default capability for contributors who can create posts). The payload is injected via the block's 'suffixMain' attribute and stored within a Gutenberg block-delimiter comment; standard WordPress wp_kses_post sanitization does NOT neutralize it because it is only converted to live HTML at the PHP render stage. Limiting factors: exploitation is gated on the site permitting contributor-level (untrusted) authors - single-admin sites have little exposure - and payload execution is deferred until a victim views the affected page.

This is a genuine but moderate-priority issue, not a critical one. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) accurately reflects a low-privilege authenticated stored XSS with changed scope: an attacker needs only contributor-level access, no user interaction to plant the payload, and execution crosses a security boundary (attacker's stored content runs in a victim's browser session), justifying S:C and the C:L/I:L partial impacts. No EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation status is 'no public exploit identified at time of analysis' - this is not evidence of active exploitation. There is no SSVC decision data in the input; on its own merits the flaw is not automatable (requires an authenticated contributor account per target site) and technical impact is partial rather than total. The most important nuance, well-documented in the description, is that this bypasses WordPress core wp_kses_post sanitization because the payload lives inside a Gutenberg block-delimiter comment and is only materialized as HTML at the PHP render stage - meaning defenders relying on core sanitization gain no protection. No signals conflict; the CVSS is consistent with the described mechanism. Bottom line: prioritize patching on multi-author sites where untrusted contributors exist, but this is not a mass-exploitation, network-unauthenticated emergency.

An attacker who has obtained (or been granted) a contributor account on a WordPress site running Gutenverse <=4.0.8 inserts a Post Comment Block and places a malicious script payload in the block's 'suffixMain' attribute, which is saved inside the block-delimiter comment and survives wp_kses_post. When an administrator, editor, or visitor later views the page, the script is rendered as HTML at the PHP render stage and executes in their browser, enabling session/cookie theft or actions in the victim's context. No public exploit code is identified at time of analysis, and exploitation requires the attacker to already hold contributor-level access.