PT-2026-43544 · Jegstudio · Gutenverse – Wordpress Blocks

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-3001

Mitre

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. Specifically, the render content() method in class-search-result-title.php outputs the value of get query var('s') directly into the page HTML without applying esc html() or any other escaping function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a crafted URL that execute if a user clicks the link, provided the gutenverse/search-result-title block is present on the site's search results template.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3001

Affected Products

Gutenverse – Wordpress Blocks

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-3001 · Security Note
• https://plugins.trac.wordpress.org/browser/gutenverse/trunk/includes/block/class-search-result-title.php#L29 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/23518a21-7b76-4edb-9a35-b6f623ed50a7?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3468383 · Note