Stored Cross-Site Scripting in Gutenverse Plugin for WordPress

CVE-2026-92746

What is CVE-2026-92746?

The Gutenverse plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the Post Comment Block 'suffixMain' attribute across all versions up to 4.0.8. This security issue arises from inadequate input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious web scripts. The flaw allows these scripts to execute on pages viewed by users, as the payload is saved within a Gutenberg block comment delimiter and only rendered as vulnerable HTML during the PHP render phase, bypassing standard sanitization measures associated with wp_kses_post.

References