CVE-2026-2868: Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG' parameter in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2868?
CVE-2026-2868 is considered a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2026-2868?
To fix CVE-2026-2868, update the Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin to version 3.5.4 or later.
What type of vulnerability is CVE-2026-2868?
CVE-2026-2868 is classified as an Authenticated Stored Cross-Site Scripting vulnerability.
Who is affected by CVE-2026-2868?
Users of Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem versions up to 3.5.3 are affected by CVE-2026-2868.
What can attackers do with CVE-2026-2868?
Attackers exploiting CVE-2026-2868 can execute arbitrary scripts in the context of authenticated users, potentially compromising site security.