CVE-2026-3002 in Gutenverse Plugin
Summary
by MITRE • 08/26/2026
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The Gutenverse plugin, specifically the Ultimate WordPress FSE Blocks Addons & Ecosystem extension, presents a significant security risk due to a stored cross-site scripting vulnerability affecting all versions up through 4.0.2. This flaw stems from insufficient input sanitization and output escaping mechanisms within multiple block components of the plugin. The core technical deficiency lies in the failure to properly validate or encode user-supplied data before it is processed by the application logic, allowing malicious scripts to be embedded directly into stored content such as posts, pages, or custom post types managed through these blocks.
The operational impact of this vulnerability is severe because it enables authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into website content. Unlike reflected XSS where the payload must be delivered via a link, stored XSS persists on the server side, meaning that every user who views the compromised page will have their browser execute the injected script automatically. This can lead to session hijacking, credential theft, defacement of the site, or redirection to malicious domains, effectively compromising not only the attacker's account but also all visitors interacting with the affected content.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing the payload in the database and executing it later places it firmly within the stored variant of XSS. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1059, Command and Control via Application Layer Protocol, specifically when used for initial access or persistence through web application manipulation, as well as T1204, User Execution, where victims are tricked into executing malicious code by viewing compromised content.
Mitigation strategies should prioritize immediate upgrading to a patched version of the Gutenverse plugin if one is available from the official repository. For organizations unable to upgrade immediately, implementing strict input validation and output encoding at the application layer can help mitigate risks. Security teams should also enforce least-privilege access controls for WordPress user roles, ensuring that only trusted administrators have elevated permissions capable of injecting content into public-facing pages. Additionally, deploying a Web Application Firewall with rules tuned to detect common XSS payloads in POST requests targeting block editor endpoints can provide an additional layer of defense against exploitation attempts.