Gutenverse Wordpress Blocks Page Builder Site Editor
Monthly
Stored cross-site scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions up to and including 4.0.8) lets an authenticated attacker holding contributor-level access or above inject arbitrary JavaScript through the Post Comment Block's 'suffixMain' attribute, which is written into a Gutenberg block-delimiter comment and only converted into live HTML when the block is rendered server-side in PHP. The stored script then executes in the browser of any user who views the affected page, scoring CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) because exploitation crosses the block-content trust boundary even though the injected account is only a low-privileged author. Exposure is gated on the site actually granting contributor-level publishing rights and on a victim later visiting the poisoned page; no public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (not listed in CISA KEV), which positions this as a genuine but moderate-priority issue rather than a critical one.
Stored Cross-Site Scripting in the Gutenverse FSE blocks plugin for WordPress (all versions through 4.0.2) enables authenticated attackers holding Contributor-level accounts or higher to embed persistent malicious JavaScript into page content via multiple vulnerable block types. Because the injected payload executes automatically in any visitor's browser session, the attack surface extends beyond the contributing user to all site visitors and administrators who load the affected pages. Exploitation requires no public exploit kit - the attack is straightforward for any party who can author content on the target WordPress site, and the CVSS scope change (S:C) reflects the cross-context browser impact.
Stored Cross-Site Scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions through 4.0.2) permits authenticated contributors to persist arbitrary JavaScript via the titleTag block attribute. The vulnerability is architecturally subtle: the malicious payload bypasses WordPress's wp_kses_post sanitization at save time by residing inside a Gutenberg block-comment delimiter, and the dangerous HTML is only synthesized when do_blocks() renders the page, at which point no further escaping is applied. Because the injected script fires in administrator and editor browser sessions during post preview, a contributor can effectively escalate impact to admin-level session hijacking. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the Gutenverse WordPress Blocks, Page Builder & Site Editor plugin (all versions through 3.8.0) enables authenticated editor-level users to persist arbitrary JavaScript into pages served to any site visitor. The vulnerability is constrained to WordPress multi-site installations or single-site deployments where unfiltered_html has been explicitly disabled. No public exploit has been identified at time of analysis, and a upstream fix commit (changeset 3578328) has been published to the WordPress plugin repository.
Stored cross-site scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions up to and including 4.0.8) lets an authenticated attacker holding contributor-level access or above inject arbitrary JavaScript through the Post Comment Block's 'suffixMain' attribute, which is written into a Gutenberg block-delimiter comment and only converted into live HTML when the block is rendered server-side in PHP. The stored script then executes in the browser of any user who views the affected page, scoring CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) because exploitation crosses the block-content trust boundary even though the injected account is only a low-privileged author. Exposure is gated on the site actually granting contributor-level publishing rights and on a victim later visiting the poisoned page; no public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (not listed in CISA KEV), which positions this as a genuine but moderate-priority issue rather than a critical one.
Stored Cross-Site Scripting in the Gutenverse FSE blocks plugin for WordPress (all versions through 4.0.2) enables authenticated attackers holding Contributor-level accounts or higher to embed persistent malicious JavaScript into page content via multiple vulnerable block types. Because the injected payload executes automatically in any visitor's browser session, the attack surface extends beyond the contributing user to all site visitors and administrators who load the affected pages. Exploitation requires no public exploit kit - the attack is straightforward for any party who can author content on the target WordPress site, and the CVSS scope change (S:C) reflects the cross-context browser impact.
Stored Cross-Site Scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions through 4.0.2) permits authenticated contributors to persist arbitrary JavaScript via the titleTag block attribute. The vulnerability is architecturally subtle: the malicious payload bypasses WordPress's wp_kses_post sanitization at save time by residing inside a Gutenberg block-comment delimiter, and the dangerous HTML is only synthesized when do_blocks() renders the page, at which point no further escaping is applied. Because the injected script fires in administrator and editor browser sessions during post preview, a contributor can effectively escalate impact to admin-level session hijacking. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the Gutenverse WordPress Blocks, Page Builder & Site Editor plugin (all versions through 3.8.0) enables authenticated editor-level users to persist arbitrary JavaScript into pages served to any site visitor. The vulnerability is constrained to WordPress multi-site installations or single-site deployments where unfiltered_html has been explicitly disabled. No public exploit has been identified at time of analysis, and a upstream fix commit (changeset 3578328) has been published to the WordPress plugin repository.