CVE-2026-3001

MEDIUMNuclei

Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-3001 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. Specifically, the `render_content()` method in `class-search-result-title.php` outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()` or any other escaping function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a crafted URL that execute if a user clicks the link, provided the `gutenverse/search-result-title` block is present on the site's search results template.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 27, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Gutenverse – WordPress Blocks, Page Builder & Site Editor

Browse jegstudio / Gutenverse – WordPress Blocks, Page Builder & Site Editor

Default status: unaffected

CVE ListThrough 3.4.6affected

Nuclei templates

1
ProjectDiscoveryMEDIUMGutenverse Plugin <= 3.4.6 - Cross-Site ScriptingCVSS 6.1

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the `render_content()` method of `class-search-result-title.php`, which outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()`. This makes it possible for unauthenticated attackers to inject and execute arbitrary web scripts in pages via a crafted URL, provided the `gutenverse/search-result-title` block is present on the site's search results template.

Impact

Unauthenticated attackers can execute arbitrary scripts in users' browsers, leading to session hijacking or phishing.

Remediation

Update to a version later than 3.4.6 or latest available version.

WeaknessesCWE-79
Authorscoffeetaro_12
Template tagscvecve2026xsswordpressgutenversewp-pluginwp
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
https://www.cve.org/CVERecord?id=CVE-2026-3001 https://wpscan.com/vulnerability/b4d5571b-fcbf-409d-be91-efcfe9a3fa95/ https://patchstack.com/database/wordpress/plugin/gutenverse/vulnerability/wordpress-gutenverse-wordpress-blocks-page-builder-site-editor-plugin-3-4-6-reflected-cross-site-scripting-vulnerability

Source: ProjectDiscovery

References

4