CVE-2026-19943: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in jegstudio Gutenverse – WordPress Blocks, Page Builder & Site Editor

CVE-2026-19943 is a stored cross-site scripting vulnerability in the Gutenverse WordPress plugin (versions up to 4.0.2). The issue is due to improper neutralization of input in the 'titleTag' block attribute, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level privileges or higher to inject arbitrary scripts. These scripts are stored inside block-comment delimiters, bypassing wp_kses_post sanitization on save, and are executed during rendering by do_blocks(), affecting all users who access the injected page, including administrators and editors during previews.

An attacker with contributor-level access or higher can inject malicious JavaScript that executes in the context of users viewing the affected pages. This can lead to theft of session tokens, privilege escalation, or other actions permitted by the victim's privileges. The vulnerability affects confidentiality and integrity but does not impact availability. The attack surface includes all users who view the compromised content, including privileged users during post previews.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'titleTag' block attribute. Monitor for updates from the vendor and apply official patches promptly once released.