WordPress plugin
Gutenberg security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 6 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium6
- Low0
All Gutenberg vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤21.8.2Update to 21.9.0 | CVE-2025-64354 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block ≤6.5.4Update to 5.9.10 or 6.0.9 or 6.1.7 or 6.2.6 or 6.3.5 or 6.4.5 or 6.5.5 | CVE-2024-31111 | |
| Medium6.4 | 18.0.0 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block 12.9.0 – 18.0.0Update to 18.01 | — | |
| Medium6.4 | Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes ≤6.3.1Update to 5.9.8 or 6.0.6 or 6.1.4 or 6.2.3 or 6.3.2 | CVE-2023-38000 | |
| Medium6.4 | Authenticated Cross-Site Scripting in Various Blocks ≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | CVE-2022-43500 | |
| Medium5.4 | Prototype Pollution via Block Editor ≤5.9.1Update to 3.7.38 or 3.8.38 or 3.9.36 or 4.0.35 or 4.1.35 or 4.2.32 or 4.3.28 or 4.4.27 or 4.5.26 or 4.6.23 or 4.7.23 or 4.8.19 or 4.9.20 or 5.0.16 or 5.1.13 or 5.2.15 or 5.3.12 or 5.4.10 or 5.5.9 or 5.6.8 or 5.7.6 or 5.8.4 or 5.9.2 | — |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤21.8.2Update to 21.9.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block
≤6.5.4Update to 5.9.10 or 6.0.9 or 6.1.7 or 6.2.6 or 6.3.5 or 6.4.5 or 6.5.5
- Medium6.418.0.0 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
12.9.0 – 18.0.0Update to 18.01
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes
≤6.3.1Update to 5.9.8 or 6.0.6 or 6.1.4 or 6.2.3 or 6.3.2
- Medium6.4Authenticated Cross-Site Scripting in Various Blocks
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- Medium5.4Prototype Pollution via Block Editor
≤5.9.1Update to 3.7.38 or 3.8.38 or 3.9.36 or 4.0.35 or 4.1.35 or 4.2.32 or 4.3.28 or 4.4.27 or 4.5.26 or 4.6.23 or 4.7.23 or 4.8.19 or 4.9.20 or 5.0.16 or 5.1.13 or 5.2.15 or 5.3.12 or 5.4.10 or 5.5.9 or 5.6.8 or 5.7.6 or 5.8.4 or 5.9.2
Gutenberg: common questions
Does Gutenberg have known vulnerabilities?
Yes. VulnCrest Radar lists 6 known vulnerabilities in Gutenberg: 6 medium. None are known to affect version null.
How do I check which version of Gutenberg I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Gutenberg vulnerability?
CVE-2025-64354, published Oct 25, 2025: Gutenberg <= 21.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any Gutenberg vulnerability listed in CISA KEV?
No. None of the known Gutenberg vulnerabilities is currently listed in the CISA KEV catalog.