CVE-2026-19943

Name of the Vulnerable Software and Affected Versions Gutenverse – WordPress Blocks, Page Builder & Site Editor versions prior to 4.0.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. By injecting arbitrary web scripts into the titleTag block attribute, the payload is stored within a block-comment delimiter and executed when a user accesses the affected page. This execution occurs during render time via the do blocks() function, affecting administrator and editor sessions during post previews.

Recommendations Update the plugin to version 4.0.3 or later. As a temporary mitigation, restrict the ability of users with contributor-level access to edit block attributes until the update is applied.