Stored Cross-Site Scripting Vulnerability in Gutenify Plugin for WordPress
CVE-2025-8605

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Gutenify – Visual Site Builder Blocks & Site Templates.
Vendor
CVE Published:
18 November 2025

What is CVE-2025-8605?

The Gutenify plugin for WordPress suffers from a vulnerability that allows authenticated users with contributor-level access and above to execute arbitrary web scripts through insufficient input sanitization and output escaping on the plugin's block attributes. When these malicious scripts are injected into pages, they can execute whenever a user visits the affected page, posing significant security risks to both the site and its visitors.

Affected Version(s)

Gutenify – Visual Site Builder Blocks & Site Templates. * <= 1.5.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/gutenify/#developers

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D.Sim
JSON
.
CVE-2025-8605 : Stored Cross-Site Scripting Vulnerability in Gutenify Plugin for WordPress