Gutenverse – WordPress Blocks, Page Builder & Site Editor

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Gutenverse – WordPress Blocks, Page Builder & Site Editor

Information

Software Type Plugin
Software Slug gutenverse (view on wordpress.org)
Software Status Active
Software Author jegstudio
Software Website gutenverse.com
Software Downloads 1,376,790
Software Active Installs 20,000
Software Record Last Updated July 16, 2026

12 Vulnerabilities

Submit a Vulnerability
Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter
4.4
CVE-2026-12399
Jun 26, 2026
Researchers: R4mbb, R4mbb
Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter
6.1
CVE-2026-3001
May 26, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'
6.4
CVE-2026-2948
May 4, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'
6.4
CVE-2026-2868
May 4, 2026
Researcher: Athiwat Tiprasaharn (Jitlada)
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'
6.4
CVE-2026-2924
Apr 3, 2026
Researcher: Muhammad Yudha - DJ
Gutenverse <= 3.2.1 - Missing Authorization
4.3
CVE-2025-66065
Nov 28, 2025
Researcher: Denver Jackson
Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks
6.4
CVE-2025-7727
Aug 5, 2025
Researcher: zer0gh0st
Gutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block
6.4
CVE-2025-2893
Apr 28, 2025
Researcher: Webbernaut
Gutenverse <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-43920
Aug 26, 2024
Researcher: João Pedro Soares de Alcântara
Gutenverse <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-38785
Jul 19, 2024
Researcher: João Pedro Soares de Alcântara
Gutenverse <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-3692
Apr 12, 2024
Researcher: Dmitrii Ignatyev
Gutenverse <= 1.8.5 - Missing Authorization via 'data/update' API Endpoint
5.3
CVE-2023-35875
Jun 19, 2023
Researcher: Kévin Mosbahi (Mika)
Title Status CVE ID CVSS Researchers Date
Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter Patched CVE-2026-12399 4.4 R4mbb, R4mbb June 26, 2026
Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter Patched CVE-2026-3001 6.1 Osvaldo Noe Gonzalez Del Rio (Os) May 26, 2026
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl' Patched CVE-2026-2948 6.4 Osvaldo Noe Gonzalez Del Rio (Os) May 4, 2026
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG' Patched CVE-2026-2868 6.4 Athiwat Tiprasaharn (Jitlada) May 4, 2026
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad' Patched CVE-2026-2924 6.4 Muhammad Yudha - DJ April 3, 2026
Gutenverse <= 3.2.1 - Missing Authorization Patched CVE-2025-66065 4.3 Denver Jackson November 28, 2025
Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks Patched CVE-2025-7727 6.4 zer0gh0st August 5, 2025
Gutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block Patched CVE-2025-2893 6.4 Webbernaut April 28, 2025
Gutenverse <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-43920 6.4 João Pedro Soares de Alcântara August 26, 2024
Gutenverse <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-38785 6.4 João Pedro Soares de Alcântara July 19, 2024
Gutenverse <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-3692 6.4 Dmitrii Ignatyev April 12, 2024
Gutenverse <= 1.8.5 - Missing Authorization via 'data/update' API Endpoint Patched CVE-2023-35875 5.3 Kévin Mosbahi (Mika) June 19, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation