CVE-2026-19943: Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious titleTag value survives wpksespost on save because it is stored inside a block-comment delimiter and the live HTML is only synthesized at render time by doblocks(), meaning the payload also fires in administrator and editor sessions during post preview.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPressto a version that resolves this vulnerability.Fixed in 4.0.2 - Compensating control
Because the vulnerability can fire during post preview/render for admin/editor sessions, restrict editor access (preview/render) to trusted users only; limit contributor-level permissions so untrusted contributors cannot create or modify Gutenverse block content containing 'titleTag' attributes.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level access or higher. They can place a malicious titleTag block attribute into a page.
Who is at risk when a malicious page is viewed?
The injected script executes for users who access the affected page. Administrator and editor sessions are also exposed when previewing the malicious post.
Are installations running Gutenverse 4.0.2 affected?
Yes. The issue affects all Gutenverse versions up to and including 4.0.2.
How does the payload persist despite WordPress sanitization?
The malicious titleTag value is stored inside a block-comment delimiter, allowing it to survive wp_kses_post during saving. The live HTML is generated later when do_blocks() renders the page.