Description

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core wp_kses_post sanitization does not mitigate this vulnerability because the payload is stored inside a Gutenberg block delimiter comment rather than as a raw HTML tag, and is only rendered as exploitable HTML at the PHP render stage.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-25T07:16:55.473Z",
  "pubdate": "2026-09-25T07:16:55.473Z",
  "executiveSummary": "The Gutenverse plugin for WordPress, in versions up to and including 4.0.8, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability via the Post Comment Block 'suffixMain' attribute.\nThe vulnerability originates from inadequate input sanitization and output escaping, allowing authenticated users with contributor-level privileges or higher to inject arbitrary malicious scripts.\nWhen a user navigates to a compromised page, the injected script executes within their browser context, potentially leading to unauthorized actions, session hijacking, or sensitive data exposure.\nThe flaw bypasses standard WordPress security filters, such as wp_kses_post, because the payload is encapsulated within Gutenberg block delimiter comments. The malicious script is dynamically rendered into the HTML document during the server-side PHP rendering process.\nThis vulnerability presents a significant risk to site integrity and user security, necessitating immediate attention to prevent unauthorized code execution.",
  "technicalDetails": "The vulnerability resides within the rendering logic of the Post Comment Block in the Gutenverse plugin. Specifically, the 'suffixMain' attribute is improperly handled, failing to undergo strict sanitization or output encoding before being processed by the application.\nThe primary root cause is the handling of block-level metadata. The WordPress core security function, wp_kses_post, is intended to strip malicious HTML tags from content; however, it fails to inspect the payload effectively because the injection occurs within a Gutenberg block delimiter comment. These comments are parsed by the WordPress block editor but are effectively treated as non-HTML metadata during initial storage.\nThe exploitation flow proceeds as follows: 1. An authenticated attacker (Contributor level or higher) accesses the WordPress block editor. 2. The attacker modifies the 'suffixMain' attribute of a Post Comment Block to include a crafted malicious payload (e.g., a <script> tag). 3. Upon saving the post, the payload is committed to the database within the block delimiter structure. 4. When a user (e.g., a visitor or administrator) views the rendered post, the PHP rendering engine parses the block metadata. 5. During the conversion from block markup to HTML, the 'suffixMain' attribute is rendered directly into the page source without further sanitization. 6. The browser interprets the injected payload as executable code rather than plain text, triggering the XSS.\nBecause the payload resides in the block's delimiter comments, it circumvents standard content-level security filters applied during the saving process. The risk is elevated because the injection point is persistent (Stored XSS), meaning every instance of the infected block triggers the script execution for any user accessing the page. The attack requires authenticated access, which limits the initial threat vector to authorized site users, but the potential for lateral movement—such as stealing session cookies or administrative credentials through malicious script execution—remains high. The vulnerability exists across all versions up to 4.0.8, highlighting a critical failure in the plugin's data input validation pipeline and output serialization process."
}