CVE-2026-3002: Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs an authenticated WordPress account with at least Contributor-level access. They can inject script content through affected Gutenverse blocks into pages.
When does the injected script run?
The malicious script is stored in the page and executes whenever a user accesses that injected page. This can affect other users who view the page, not only the contributor who created it.
Which versions are affected?
All Gutenverse versions up to and including 4.0.2 are affected. The provided information does not identify a fixed version.