Junglewise Threat Intelligence

CVE-2026-12399: Jegstudio Gutenverse Stored XSS in admin settings

CVE-2026-12399 · Severity: medium · CVSS 4.4 · Published 2026-06-27

Executive brief

The Gutenverse plugin for WordPress, which provides page building and site editing tools, contains a security flaw in its administrative settings. An attacker with editor-level permissions or higher can inject malicious scripts into website pages. This could lead to unauthorized actions being performed in the browsers of other users, including administrators, when they view the affected pages. This issue primarily impacts WordPress multi-site environments or sites with specific security restrictions disabled.

Technical details

This vulnerability is a Stored Cross-Site Scripting (XSS) issue residing in the admin settings of the Gutenverse WordPress plugin. The root cause is insufficient input sanitization and output escaping within several framework files, including helper.php and class-api.php. An authenticated attacker with at least Editor-level privileges can exploit this by injecting malicious JavaScript into settings fields. The payload is then stored and executed in the context of any user (including Super Admins) who visits the affected page. The vulnerability is most impactful in WordPress Multi-site environments or single-site installs where the 'unfiltered_html' capability has been explicitly disabled for high-level users. All versions up to and including 3.8.0 are affected.

Affected products

  • jegstudio Gutenverse – WordPress Blocks, Page Builder & Site Editor up to, and including, 3.8.0

Timeline

  • 2026-06-27: advisory: NVD publication date

References