CVE-2026-121721: WordPress Gutenberg Blocks plugin <= 3.7.6 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The attack is network-accessible and has low complexity, but requires low-level privileges and user interaction. The affected input can be stored and later used to trigger XSS when a user interacts with the rendered content.

Q: What is the expected impact if exploitation succeeds?

The available severity vector indicates low impacts to confidentiality, integrity, and availability, with scope changed. This means the effect may extend beyond the initially vulnerable component or security authority.

Published Nov 13, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Stored XSS.This issue affects Gutenberg Blocks: from n/a through 3.7.6.

Affected Software

1 affected component

PublishPress Gutenberg Blocks<=3.7.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PublishPress Gutenberg Blocks to a version that resolves this vulnerability.
Fixed in 3.7.7

Event History

Nov 13, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attack is network-accessible and has low complexity, but requires low-level privileges and user interaction. The affected input can be stored and later used to trigger XSS when a user interacts with the rendered content.

What is the expected impact if exploitation succeeds?