CVE-2026-12399 is a stored cross-site scripting vulnerability (CWE-79) in the Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin. Versions up to and including 3.8.0 are affected. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of admin settings input. Authenticated attackers with editor-level permissions or higher can inject arbitrary scripts that execute when users view the injected pages. This vulnerability impacts multi-site WordPress installations and installations where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4 (medium severity), with attack vector network, high attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, no impact on availability. No patch or official fix has been disclosed as of the publication date.

An attacker with editor-level permissions or higher can inject malicious scripts into pages via admin settings. These scripts execute in the context of users viewing the affected pages, potentially leading to session hijacking, privilege escalation, or other attacks that rely on script execution in the victim's browser. The vulnerability is limited to multi-site installations or sites with unfiltered_html disabled, reducing the overall attack surface. The impact is rated as medium with limited confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict editor-level permissions to trusted users only and consider disabling multi-site features or enabling unfiltered_html capability if feasible. Monitor vendor communications for updates on patches or official mitigations.