CVE-2026-19943 is a stored cross-site scripting vulnerability in the Gutenverse WordPress plugin affecting all versions up to 4.0.2. The vulnerability arises from insufficient input sanitization and output escaping of the 'titleTag' block attribute. The malicious payload survives the wp_kses_post sanitization due to being stored inside a block-comment delimiter and is executed during rendering by the do_blocks() function. This allows authenticated users with contributor or higher privileges to inject arbitrary scripts that execute in the context of users viewing the injected page, including administrators and editors during previews.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages via the 'titleTag' attribute. These scripts execute in the browsers of users who view the compromised pages, potentially leading to session hijacking, privilege escalation, or other attacks that leverage the victim's privileges. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 6.4 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider reviewing and sanitizing content before publishing. Monitor official vendor channels for updates or patches addressing this vulnerability.