CVE-2026-2924
Stored XSS in Gutenverse WordPress Plugin Allows Script Injection
Publication date: 2026-04-04
Last updated on: 2026-04-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yogajegstudio | gutenverse | to 3.4.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'imageLoad' parameter in versions up to and including 3.4.6.
This vulnerability exists because of insufficient input sanitization and output escaping, which allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.
These injected scripts execute whenever any user accesses the page containing the malicious code.
How can this vulnerability impact me? :
This vulnerability can allow attackers with contributor-level access to inject malicious scripts into pages.
When other users visit these pages, the malicious scripts will execute in their browsers, potentially leading to theft of user credentials, session hijacking, defacement, or other malicious actions.
Because the vulnerability is a Stored Cross-Site Scripting, the malicious code persists on the affected site and can impact multiple users.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the Stored Cross-Site Scripting vulnerability in the Gutenverse plugin, you should update the plugin to version 3.4.7 or later, where the issue has been fixed.
This update addresses the insufficient input sanitization and output escaping related to the 'imageLoad' parameter.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts via Stored Cross-Site Scripting (XSS). This can lead to unauthorized access to user data or session hijacking, which may compromise the confidentiality and integrity of personal data.
Such a compromise could potentially violate data protection regulations like GDPR or HIPAA, which require adequate security measures to protect personal and sensitive information from unauthorized access or disclosure.
However, the provided information does not explicitly state the impact on compliance with these standards.