The Gutenverse WordPress plugin suffers from a stored XSS vulnerability due to improper neutralization of input in the 'separatorIconSVG' parameter. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript code that will execute in the context of other users viewing the injected pages. This vulnerability is tracked as CVE-2026-2868 with a CVSS 3.1 base score of 6.4 (medium severity). No vendor advisory or patch is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows an attacker with contributor-level access or higher to inject persistent malicious scripts into pages generated by the plugin. This can lead to the execution of arbitrary scripts in the browsers of users who view the compromised pages, potentially resulting in session hijacking, privilege escalation, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting contributor-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using or displaying untrusted input in the 'separatorIconSVG' parameter. Applying general WordPress security best practices may help reduce risk but will not fully mitigate this vulnerability without a vendor patch.