PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3001 jegstudio CVE debrief

A reflected cross-site scripting (XSS) vulnerability in the Gutenverse WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. The vulnerability exists in the `render_content()` method within `class-search-result-title.php`, which outputs the search query parameter directly into HTML without proper escaping. Successful exploitation requires the `gutenverse/search-result-title` block to be present on the site's search results template, and depends on a user clicking a malicious link. The issue affects all versions up to and including 3.4.6. A changeset (3468383) has been committed to address the vulnerability.

Vendor
jegstudio
Product
Gutenverse – WordPress Blocks, Page Builder & Site Editor
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

WordPress site administrators using the Gutenverse plugin, particularly those with search functionality enabled and the search-result-title block active on search templates. Security teams monitoring WordPress plugin vulnerabilities and managing web application firewall policies.

Technical summary

The Gutenverse plugin for WordPress versions up to and including 3.4.6 contains a reflected XSS vulnerability in the search-result-title block. The `render_content()` method in `includes/block/class-search-result-title.php` outputs `get_query_var('s')` directly without escaping, allowing attackers to inject scripts via the 's' URL parameter. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, scoring 6.1 (Medium). Exploitation requires user interaction (clicking a crafted link) and presence of the vulnerable block on the search results template.

Defensive priority

medium

Recommended defensive actions

  • Update the Gutenverse plugin to a version later than 3.4.6 as soon as a patched release is available
  • Verify that the `gutenverse/search-result-title` block is not used on search results templates, or temporarily remove it if updates are not immediately feasible
  • Implement Content Security Policy (CSP) headers to mitigate the impact of XSS vulnerabilities
  • Review web application firewall (WAF) rules to detect and block reflected XSS attempts targeting the search parameter
  • Audit site logs for suspicious requests containing HTML or JavaScript payloads in the 's' search parameter

Evidence notes

The vulnerability was reported by Wordfence and is documented in the Wordfence Threat Intelligence database. Source code analysis confirms the vulnerable code path at line 29 of `class-search-result-title.php`, where `get_query_var('s')` is output without `esc_html()` or equivalent escaping. A patch has been committed to the plugin repository as changeset 3468383.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-3001 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-3001

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-3001 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3001

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.