CVE-2026-92746

Name of the Vulnerable Software and Affected Versions Gutenverse versions prior to 4.0.9

Description The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via the suffixMain attribute of the Post Comment Block. This occurs because of insufficient input sanitization and output escaping. The issue persists despite WordPress core wp kses post sanitization because the payload is stored within a Gutenberg block delimiter comment and is only rendered as exploitable HTML during the PHP render stage.

Recommendations Update the plugin to version 4.0.9 or later.