Jegstudio Vulnerabilities and Affected Products
Vulnerabilities associated with Gutenverse – WordPress Blocks, Page Builder & Site Editor.
Products
Clear product- Gutenverse5 vulnerabilities
- Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem5 vulnerabilities
- Gutenverse Companion2 vulnerabilities
- Gutenverse Form2 vulnerabilities
- Gutenverse – WordPress Blocks, Page Builder & Site Editor2 vulnerabilities
- Financio1 vulnerability
- Gutenverse Form – Contact Form Builder, Booking, Reservation, Subscribe for Block Editor1 vulnerability
- Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons1 vulnerability
- Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons1 vulnerability
- Startupzy1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-12399MEDIUM | Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' ParameterThe Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and install… CWE-79Jun 27, 2026 | CVSS4.4v3.1 | EPSS0.244% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-3001MEDIUM | Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' ParameterThe Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. Specifically, the `render_content()` method in `class-search-result-title.php` outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()` or any other escaping function. This makes it possible for unauthenticated attackers to inject arbitrary web sc… | CVSS6.1v3.1 | EPSS0.204% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |