CVE-2026-2924 in Gutenverse Plugin
摘要 (英语)
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageLoad' parameter in versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
负责
Wordfence
预定
2026-02-21
披露
2026-04-04
状态
已确认
条目
VulDB provides additional information and datapoints for this CVE:
| 标识符 | 漏洞 | CWE | 可利用 | 对策 | CVE |
|---|---|---|---|---|---|
| 355229 | jegstudio Gutenverse Plugin Parameter 跨网站脚本 | 79 | 未定义 | 未定义 | CVE-2026-2924 |