Stored XSS Vulnerability in PublishPress Gutenberg Blocks by WordPress
CVE-2026-121721

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Gutenberg Blocks
Vendor
CVE Published:
13 November 2026

What is CVE-2026-121721?

The vulnerability in PublishPress Gutenberg Blocks allows for stored Cross-site Scripting (XSS) attacks. This occurs due to improper neutralization of user input during web page generation, enabling malicious actors to inject harmful scripts. The issue affects all versions up to and including 3.7.6, posing a security risk to websites utilizing this plugin. Users are advised to update to a patched version to safeguard against these types of attacks and protect sensitive data.

Affected Version(s)

Gutenberg Blocks 0 <= 3.7.6

References

https://patchstack.com/database/wordpress/plugin/advanced...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mroccon | Patchstack Bug Bounty Program
.