Gutenverse Vulnerabilities

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Con...

CVSS:

6.4

Affected:

up to 4.0.2

Fixed in:

4.0.3

Disclosed:

Aug 25, 2026

CVE-2026-3002 on NVD →

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 4.0.2

Fixed in:

4.0.3

Disclosed:

Aug 24, 2026

CVE-2026-19943 on NVD →

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level...

CVSS:

4.4

Affected:

up to 3.8.0

Fixed in:

3.8.1

Disclosed:

Jun 26, 2026

CVE-2026-12399 on NVD →

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. Specifically, the `render_content()` method in `class-search-result-title.php` outputs the value of `get_query...

CVSS:

6.1

Affected:

up to 3.4.6

Fixed in:

3.4.7

Disclosed:

May 26, 2026

CVE-2026-3001 on NVD →

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.5.3 via the import_images() function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests...

CVSS:

6.4

Affected:

up to 3.5.3

Fixed in:

3.6.0

Disclosed:

May 4, 2026

CVE-2026-2948 on NVD →

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG' parameter in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVSS:

6.4

Affected:

up to 3.5.3

Fixed in:

3.6.0

Disclosed:

May 4, 2026

CVE-2026-2868 on NVD →

WordPress Gutenverse - Ultimate WordPress FSE Blocks Addons & Ecosystem plugin <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad' vulnerability

CVSS:

6.5

Affected:

up to 3.4.6

Fixed in:

3.4.7

Disclosed:

Apr 3, 2026

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageLoad' parameter in versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with c...

CVSS:

6.4

Affected:

up to 3.4.6

Fixed in:

3.4.7

Disclosed:

Apr 3, 2026

CVE-2026-2924 on NVD →

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform...

CVSS:

4.3

Affected:

up to 3.2.1

Fixed in:

3.3.0

Disclosed:

Nov 28, 2025

CVE-2025-66065 on NVD →

The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 3.1.0

Fixed in:

3.1.1

Disclosed:

Aug 5, 2025

CVE-2025-7727 on NVD →

The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's countdown Block in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it pos...

CVSS:

6.4

Affected:

up to 2.2.1

Fixed in:

3.0.0

Disclosed:

Apr 28, 2025

CVE-2025-2893 on NVD →

The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 1.9.4

Fixed in:

2.0.0

Disclosed:

Aug 26, 2024

CVE-2024-43920 on NVD →

The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 1.9.2

Fixed in:

1.9.3

Disclosed:

Jul 19, 2024

CVE-2024-38785 on NVD →

The Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVSS:

6.4

Affected:

up to 1.9.0

Fixed in:

1.9.1

Disclosed:

Apr 12, 2024

CVE-2024-3692 on NVD →

The Gutenverse plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'data/update' API Endpoint function in versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to perform an unauthorized data update.

CVSS:

5.3

Affected:

up to 1.8.5

Fixed in:

1.8.6

Disclosed:

Jun 19, 2023

CVE-2023-35875 on NVD →