Gutenverse Wordpress Blocks Page Builder Site Editor
Monthly
Stored Cross-Site Scripting in the Gutenverse FSE blocks plugin for WordPress (all versions through 4.0.2) enables authenticated attackers holding Contributor-level accounts or higher to embed persistent malicious JavaScript into page content via multiple vulnerable block types. Because the injected payload executes automatically in any visitor's browser session, the attack surface extends beyond the contributing user to all site visitors and administrators who load the affected pages. Exploitation requires no public exploit kit - the attack is straightforward for any party who can author content on the target WordPress site, and the CVSS scope change (S:C) reflects the cross-context browser impact.
Stored Cross-Site Scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions through 4.0.2) permits authenticated contributors to persist arbitrary JavaScript via the titleTag block attribute. The vulnerability is architecturally subtle: the malicious payload bypasses WordPress's wp_kses_post sanitization at save time by residing inside a Gutenberg block-comment delimiter, and the dangerous HTML is only synthesized when do_blocks() renders the page, at which point no further escaping is applied. Because the injected script fires in administrator and editor browser sessions during post preview, a contributor can effectively escalate impact to admin-level session hijacking. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the Gutenverse WordPress Blocks, Page Builder & Site Editor plugin (all versions through 3.8.0) enables authenticated editor-level users to persist arbitrary JavaScript into pages served to any site visitor. The vulnerability is constrained to WordPress multi-site installations or single-site deployments where unfiltered_html has been explicitly disabled. No public exploit has been identified at time of analysis, and a upstream fix commit (changeset 3578328) has been published to the WordPress plugin repository.
Stored Cross-Site Scripting in the Gutenverse FSE blocks plugin for WordPress (all versions through 4.0.2) enables authenticated attackers holding Contributor-level accounts or higher to embed persistent malicious JavaScript into page content via multiple vulnerable block types. Because the injected payload executes automatically in any visitor's browser session, the attack surface extends beyond the contributing user to all site visitors and administrators who load the affected pages. Exploitation requires no public exploit kit - the attack is straightforward for any party who can author content on the target WordPress site, and the CVSS scope change (S:C) reflects the cross-context browser impact.
Stored Cross-Site Scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions through 4.0.2) permits authenticated contributors to persist arbitrary JavaScript via the titleTag block attribute. The vulnerability is architecturally subtle: the malicious payload bypasses WordPress's wp_kses_post sanitization at save time by residing inside a Gutenberg block-comment delimiter, and the dangerous HTML is only synthesized when do_blocks() renders the page, at which point no further escaping is applied. Because the injected script fires in administrator and editor browser sessions during post preview, a contributor can effectively escalate impact to admin-level session hijacking. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the Gutenverse WordPress Blocks, Page Builder & Site Editor plugin (all versions through 3.8.0) enables authenticated editor-level users to persist arbitrary JavaScript into pages served to any site visitor. The vulnerability is constrained to WordPress multi-site installations or single-site deployments where unfiltered_html has been explicitly disabled. No public exploit has been identified at time of analysis, and a upstream fix commit (changeset 3578328) has been published to the WordPress plugin repository.