The Gutenverse plugin for WordPress contains a stored XSS vulnerability in its countdown Block due to improper neutralization of input during web page generation (CWE-79). Authenticated attackers with contributor-level privileges can inject arbitrary JavaScript code via user-supplied attributes that are not properly sanitized or escaped. This malicious code executes in the context of any user viewing the affected page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 2.2.1. No patch or official fix information is provided in the available data.

An attacker with contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages using the countdown Block. These scripts execute in the browsers of users who visit the infected pages, potentially leading to theft of user credentials, session tokens, or other sensitive information. The vulnerability does not impact availability but compromises confidentiality and integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the countdown Block if possible. Monitor for updates from the vendor jegstudio regarding patches or official mitigations.