{"id":"CVE-2026-12399","aliases":["EUVD-2026-39959","GHSA-pgr2-vvf9-xmqw"],"status":"published","title":"Gutenverse \u003c= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter","description":"The Gutenverse – WordPress Blocks, Page Builder \u0026 Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00397,"percentile":0.34321,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-06-27T06:50:59Z","modified":"2026-06-29T18:40:23Z","products":[{"vendor":"jegstudio","product":"gutenverse – wordpress blocks, page builder \u0026 site editor"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd1c679b-43e0-4e3a-ae2d-f6ff8a657512?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/3.8.0/lib/framework/helper.php#L1440"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/3.8.0/lib/framework/includes/class-api.php#L1956"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/3.8.0/lib/framework/includes/class-global-variable.php#L78"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/3.8.0/lib/framework/includes/class-frontend-generator.php#L147"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/3.8.0/lib/framework/helper.php#L1775"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/3.6.3/lib/framework/helper.php#L1440"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/3.6.3/lib/framework/includes/class-api.php#L1956"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/3.6.3/lib/framework/includes/class-global-variable.php#L78"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/3.6.3/lib/framework/includes/class-frontend-generator.php#L147"},{"url":"https://plugins.trac.wordpress.org/browser/gutenverse/tags/3.6.3/lib/framework/helper.php#L1775"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3578328%40gutenverse\u0026new=3578328%40gutenverse\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12399"},{"url":"https://github.com/advisories/GHSA-pgr2-vvf9-xmqw"}],"sources":{"cve":[{"id":"CVE-2026-12399","title":"Gutenverse \u003c= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter","description":"The Gutenverse – WordPress Blocks, Page Builder \u0026 Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","status":"published","published":"2026-06-27T06:50:59.766Z","modified":"2026-06-29T12:23:58.111Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-39959","description":"The Gutenverse – WordPress Blocks, Page Builder \u0026 Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","status":"published","published":"2026-06-27T06:50:59Z","modified":"2026-06-29T12:23:58Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:23.349194Z"}],"ghsa":[{"id":"GHSA-pgr2-vvf9-xmqw","title":"The Gutenverse – WordPress Blocks, Page Builder \u0026 Site Editor plugin for WordPress is vulnerable...","description":"The Gutenverse – WordPress Blocks, Page Builder \u0026 Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","status":"published","published":"2026-06-27T09:30:37Z","modified":"2026-06-27T09:30:45Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:01.878033Z"}],"nvd":[{"id":"CVE-2026-12399","description":"The Gutenverse – WordPress Blocks, Page Builder \u0026 Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","status":"published","published":"2026-06-27T08:16:44.443Z","modified":"2026-06-29T18:40:23.203Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:26.508751Z"}]}}