CVE-2026-3002 Overview
CVE-2026-3002 is a stored Cross-Site Scripting (XSS) vulnerability in the Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress. The flaw affects all versions up to and including 4.0.2. It stems from insufficient input sanitization and output escaping across multiple blocks provided by the plugin. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. The injected scripts execute in the browser of any user who views the affected page. The weakness is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated contributors can persist JavaScript payloads inside WordPress pages, enabling session hijacking, credential theft, and admin account takeover when higher-privileged users view the injected content.
Affected Products
- Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin
- All versions up to and including 4.0.2
- WordPress sites using Gutenverse blocks such as animated-text, chart, and team
Discovery Timeline
- 2026-08-26 - CVE-2026-3002 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-3002
Vulnerability Analysis
The Gutenverse plugin extends the WordPress block editor with Full Site Editing (FSE) blocks including animated text, charts, and team member components. Several of these blocks accept attribute values that are rendered on the front end without proper sanitization or output escaping. When a contributor edits a page using an affected block, they can supply attribute data containing HTML or JavaScript. The plugin stores the payload in post content and emits it into the rendered page markup or block configuration. When a visitor loads the page, the browser executes the attacker-controlled script in the site's origin. Because the payload is stored in the database, the impact persists until the malicious content is removed.
Root Cause
The root cause is missing input sanitization on block attributes and missing output escaping when the plugin renders block markup on the front end. Block scripts such as animated-text.js, chart.js, and team.js consume attribute values that were never validated against an allowlist or passed through WordPress escaping helpers like esc_html(), esc_attr(), or wp_kses_post().
Attack Vector
Exploitation requires an authenticated account with Contributor privileges or higher. The attacker creates or edits a page containing a vulnerable Gutenverse block and inserts a JavaScript payload into an affected block attribute. The page is saved and, once viewed by any user, the payload executes in that user's browser session. If an administrator previews or reviews the page, the attacker can escalate to full site compromise. Details of the affected block scripts are available in the Gutenverse Animated Text Script, the Gutenverse Chart Script, and the Gutenverse Team Script. The vendor fix is captured in WordPress Changeset #3662715.
No verified exploit code is publicly available. See the Wordfence Vulnerability Analysis for the vendor-independent write-up.
Detection Methods for CVE-2026-3002
Indicators of Compromise
- Unexpected <script> tags, event handlers such as onerror or onload, or javascript: URIs stored in wp_posts.post_content for pages using Gutenverse blocks.
- New or modified pages authored by low-privilege Contributor accounts that contain Gutenverse animated-text, chart, or team blocks.
- Outbound requests from administrator browsers to unfamiliar domains shortly after previewing contributor-authored content.
Detection Strategies
- Query the WordPress database for Gutenverse block markers combined with script-like patterns: SELECT ID, post_author FROM wp_posts WHERE post_content LIKE '%wp:gutenverse%' AND post_content REGEXP '(<script|onerror=|onload=|javascript:)'.
- Enable a Web Application Firewall (WAF) rule to inspect POST requests to /wp-json/wp/v2/pages and /wp-admin/post.php for script payloads in Gutenverse block attributes.
- Review the plugin version reported by WordPress site health and flag any installation at 4.0.2 or below.
Monitoring Recommendations
- Alert on Contributor accounts creating or updating pages that include Gutenverse block namespaces.
- Monitor administrator sessions for anomalous XHR or fetch calls to external hosts originating from page preview or edit screens.
- Track plugin update events in the WordPress audit log to confirm remediation across all managed sites.
How to Mitigate CVE-2026-3002
Immediate Actions Required
- Update the Gutenverse plugin to the patched release published after version 4.0.2, as delivered in WordPress Changeset #3662715.
- Audit existing pages that use Gutenverse blocks and remove any content containing inline scripts or JavaScript event handlers.
- Review Contributor and Author accounts, rotate credentials for any accounts showing suspicious activity, and disable unused accounts.
Patch Information
The vendor addressed the vulnerability by adding input sanitization and output escaping to the affected blocks. The fix is included in the Gutenverse release referenced by WordPress Changeset #3662715. Site administrators should install the update through the WordPress Plugins screen or via WP-CLI using wp plugin update gutenverse.
Workarounds
- Deactivate the Gutenverse plugin until the patched version can be installed.
- Restrict page publishing privileges by removing the edit_posts and edit_pages capabilities from untrusted Contributor accounts.
- Deploy a WAF rule that blocks HTML tags and JavaScript URI schemes in block attributes submitted through the WordPress REST API.
# Update Gutenverse to the patched release using WP-CLI
wp plugin update gutenverse
# Verify installed version is above 4.0.2
wp plugin get gutenverse --field=version
# Temporary mitigation: deactivate plugin site-wide
wp plugin deactivate gutenverse
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
