Threat Entry Updated 2026-06-17

CVE-2026-3001 - Gutenverse Plugin

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. Specifically, the `render_content()` method in `class-search-result-title.php` outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()` or any other escaping function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a crafted URL that execute if a user clicks the link, provided the `gutenverse/search-result-title` block is present on the site's…

PLUGIN Gutenverse

CVE-2026-3001

MEDIUM CVSS 6.1 2026-05-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-08-06

CVE-2025-7727 - Gutenverse Plugin

The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Gutenverse

CVE-2025-7727

MEDIUM CVSS 6.4 2025-08-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-06

CVE-2025-2893 - Gutenverse Plugin

The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's countdown Block in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Gutenverse

CVE-2025-2893

MEDIUM CVSS 6.4 2025-04-29

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-08

CVE-2024-3692 - Gutenverse Plugin

The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

PLUGIN Gutenverse

CVE-2024-3692

MEDIUM CVSS 6.1 2024-05-03

Risk Score

Open Full Technical Breakdown