CVE-2026-3002: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in jegstudio Gutenverse – WordPress Blocks, Page Builder & Site Editor

The Gutenverse WordPress plugin suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated attackers with Contributor-level privileges or above can inject arbitrary web scripts into pages via multiple blocks. These scripts execute in the context of users who access the compromised pages, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to and including 4.0.2. No official patch or remediation guidance has been published yet.

An attacker with Contributor-level access or higher can inject persistent malicious scripts into pages, which execute in the browsers of users viewing those pages. This can lead to theft of user credentials, session tokens, or other sensitive information accessible via the browser. The vulnerability does not affect availability but impacts confidentiality and integrity of user data within the affected WordPress sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the affected plugin blocks to reduce exposure.