CVE-2026-92746 is a stored cross-site scripting vulnerability in the Gutenverse WordPress plugin (up to version 4.0.8) caused by improper neutralization of input in the 'suffixMain' attribute of the Post Comment Block. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the compromised pages. The issue persists because the payload is embedded inside a Gutenberg block delimiter comment, bypassing WordPress's wp_kses_post sanitization, and only becomes exploitable during PHP rendering.

An attacker with contributor-level access or higher can inject malicious JavaScript code that executes in the browsers of users who view the affected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions within the context of the affected site. The vulnerability does not affect unauthenticated users directly but leverages authenticated user privileges to persist malicious scripts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and above to trusted users only. Monitor updates from the vendor for patches addressing this vulnerability.