Description

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-26T07:16:45.633Z",
  "pubdate": "2026-08-26T07:16:45.633Z",
  "executiveSummary": "The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw exists due to inadequate input sanitization and output escaping within multiple blocks provided by the plugin.\nThe vulnerability allows authenticated attackers with Contributor-level privileges or higher to inject malicious JavaScript payloads into post or page content. When a victim, such as an administrator or a site visitor, views the affected content, the injected script executes within the context of the user's browser session.\nThe impact of this vulnerability is significant, as it can lead to unauthorized actions performed on behalf of the victim, session hijacking, or the redirection of users to malicious external domains. Because the script is stored in the WordPress database, the vulnerability persists until the malicious content is removed by an authorized user or the plugin is updated.\nThe affected product is Gutenverse, specifically in all versions up to and including 4.0.2. Remediation requires an immediate update to a secured version of the plugin once available, as the current state poses a critical risk to site integrity and user data security.",
  "technicalDetails": "The vulnerability originates from the improper handling of user-supplied data within the Gutenverse plugin's block architecture. Specifically, the plugin fails to implement sufficient input sanitization when processing parameters associated with its block components, and subsequently fails to apply context-aware output escaping when rendering this data in the front-end or back-end interface.\nBy design, WordPress blocks are parsed and saved to the database as part of the post_content. In this instance, the plugin allows Contributor-level users to input arbitrary data into block settings. Because the plugin does not enforce strict validation or whitelist-based sanitization on these inputs, an attacker can embed malicious HTML tags, such as <script> elements or event handler attributes (e.g., onerror, onload), directly into the block attributes.\nThe exploitation flow is as follows: An authenticated attacker with at least Contributor permissions navigates to the WordPress post editor. They insert a vulnerable Gutenverse block and inject a crafted XSS payload into the block's settings fields. Upon saving or publishing the post, the malicious payload is persisted in the WordPress database.\nWhen a user with higher privileges—such as an Administrator—or an end-user visits the compromised page, the server renders the stored block content. Due to the lack of output escaping, the browser interprets the injected payload as legitimate code rather than inert text. This executes the attacker's script within the security context of the victim's session.\nThe post-exploitation impact includes, but is not limited to, the ability to perform unauthorized administrative actions (e.g., creating new admin accounts, modifying site settings), stealing session cookies (which may lead to full account takeover), or performing arbitrary HTTP requests within the site's origin. The vulnerability remains effective for all versions up to and including 4.0.2. Given that block attributes are processed dynamically during page load, the execution is reliably triggered whenever the page is rendered, making it an highly effective vector for persistent client-side attacks."
}