CVE-2026-12399 is a stored cross-site scripting vulnerability (CWE-79) in the Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin. The vulnerability exists due to improper neutralization of input during web page generation, allowing authenticated users with editor or higher privileges to inject arbitrary scripts via admin settings. These scripts execute in the context of users viewing the injected pages. The vulnerability affects multi-site WordPress installations and those with unfiltered_html disabled, impacting all plugin versions up to and including 3.8.0. The CVSS 3.1 base score is 4.4, indicating medium severity, with attack vector network, high attack complexity, requiring high privileges, no user interaction, and partial impact on confidentiality and integrity.

An attacker with editor-level or higher privileges can inject persistent malicious scripts into pages via admin settings. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to unauthorized actions or data exposure within the context of the affected site. The vulnerability does not affect availability. The impact is limited to multi-site installations or sites where unfiltered_html is disabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level permissions to trusted users only and consider enabling unfiltered_html capability where appropriate. Monitor vendor channels for updates and apply patches promptly once released.