CVE-2026-2924 is a stored cross-site scripting vulnerability (CWE-79) in the Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin. The issue is due to improper neutralization of input in the 'imageLoad' parameter, allowing authenticated users with contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute when any user accesses the compromised page, potentially leading to information disclosure or session hijacking. The vulnerability affects versions up to and including 3.4.6. The CVSS 3.1 score is 6.4 (medium), with an attack vector of network, low attack complexity, privileges required at the low level, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official remediation has been confirmed.

An attacker with contributor-level or higher access can inject malicious scripts via the 'imageLoad' parameter, which are stored and executed in the context of users viewing the affected pages. This can lead to unauthorized actions such as theft of user credentials or session tokens, and manipulation of page content. The vulnerability does not impact availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider monitoring for suspicious activity related to the plugin. Avoid exposing the vulnerable parameter in untrusted contexts. No official patch or temporary fix is currently documented.