https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 09:22:21 +0000 https://db.gcve.eu/vuln/cve-2026-92746 <p><strong>Affected:</strong> jegstudio Gutenverse – WordPress Blocks, Page Builder &amp; Site Editor</p> <p>The Gutenverse – WordPress Blocks, Page Builder &amp; Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block &#39;suffixMain&#39; Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core wp_kses_post sanitization does not mitigate this vulnerability because the payload is stored inside a Gutenberg block delimiter comment rather than as a raw HTML tag, and is only rendered as exploitable HTML at the PHP render stage.</p> <p><strong>Affected:</strong> jegstudio Gutenverse – WordPress Blocks, Page Builder &amp; Site Editor</p> <p>The Gutenverse – WordPress Blocks, Page Builder &amp; Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block &#39;suffixMain&#39; Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core wp_kses_post sanitization does not mitigate this vulnerability because the payload is stored inside a Gutenberg block delimiter comment rather than as a raw HTML tag, and is only rendered as exploitable HTML at the PHP render stage.</p> https://db.gcve.eu/vuln/cve-2026-92746