Gutenberg
Monthly
Access-control bypass in the Drupal Gutenberg contrib module allows an authenticated low-privilege user to reach resources or routes they should not be permitted to access through forceful browsing. Only sites running the module at versions 0.0.0 through 2.15.0 or 3.0.0 through 3.0.7 are exposed, and the CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) confirms a valid account is required with no user interaction; the exposure is a moderate access-control weakness rather than an anonymous takeover path. No public exploit has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), so this is real but non-urgent risk that fits a normal monthly patch cadence.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.0.0 before 2.13.0, from 3.0.0 before 3.0.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. Rated low severity (CVSS 3.0), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Access-control bypass in the Drupal Gutenberg contrib module allows an authenticated low-privilege user to reach resources or routes they should not be permitted to access through forceful browsing. Only sites running the module at versions 0.0.0 through 2.15.0 or 3.0.0 through 3.0.7 are exposed, and the CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) confirms a valid account is required with no user interaction; the exposure is a moderate access-control weakness rather than an anonymous takeover path. No public exploit has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), so this is real but non-urgent risk that fits a normal monthly patch cadence.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.0.0 before 2.13.0, from 3.0.0 before 3.0.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. Rated low severity (CVSS 3.0), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.