WordPress plugin
Gutenverse – WordPress Blocks, Page Builder & Site Editor security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 15 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium15
- Low0
All Gutenverse – WordPress Blocks, Page Builder & Site Editor vulnerabilities
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute
≤4.0.8Update to 4.0.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks
≤4.0.2Update to 4.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
≤4.0.2Update to 4.0.3
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter
≤3.8.0Update to 3.8.1
- Medium6.1Reflected Cross-Site Scripting via 's' Parameter
≤3.4.6Update to 3.4.7
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'
≤3.5.3Update to 3.6.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'
≤3.5.3Update to 3.6.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'
≤3.4.6Update to 3.4.7
- Medium4.3Missing Authorization
≤3.2.1Update to 3.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks
≤3.1.0Update to 3.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block
≤2.2.1Update to 3.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.9.4Update to 2.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.9.2Update to 1.9.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.9.0Update to 1.9.1
- Medium5.3Missing Authorization via 'data/update' API Endpoint
≤1.8.5Update to 1.8.6
Gutenverse – WordPress Blocks, Page Builder & Site Editor: common questions
Does Gutenverse – WordPress Blocks, Page Builder & Site Editor have known vulnerabilities?
Yes. VulnCrest Radar lists 15 known vulnerabilities in Gutenverse – WordPress Blocks, Page Builder & Site Editor: 15 medium. None are known to affect version null.
How do I check which version of Gutenverse – WordPress Blocks, Page Builder & Site Editor I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Gutenverse – WordPress Blocks, Page Builder & Site Editor vulnerability?
CVE-2026-92746, published Sep 24, 2026: Gutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute. Severity: Medium (CVSS 6.4).
Is any Gutenverse – WordPress Blocks, Page Builder & Site Editor vulnerability listed in CISA KEV?
No. None of the known Gutenverse – WordPress Blocks, Page Builder & Site Editor vulnerabilities is currently listed in the CISA KEV catalog.