Gutenberg

Gutenberg has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 6 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (83%). Other recurring categories include Improperly Controlled Modification Of Dynamically-Determined Object Attributes.

Every one of the 6 issues recorded for Gutenberg has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (2) reported by Rafie Muhammad. Gutenberg is installed on roughly 400,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage100%
Open

0

Fixed

6

Get automatic notifications for all Gutenberg vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-64354

Gutenberg <= 21.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

6 records
Gutenberg banner
Latestv23.9.1
2.1(3,883)
42/100
Last Updated
2026-09-07 (6d ago)
Active Installs
400,000+
Downloads
51,555,489
Requires WP
6.9+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2017-06-16 (9y ago)

“Gutenberg” is a codename for a whole new paradigm for creating with WordPress, that aims to revolutionize the entire publishing experience as much as Johannes Gutenberg did the printed word. The project is following a four-phase process that will touch major pieces of WordPress — Editing, Customization, Collaboration, and Multilingual. Following the introduction of post block editing in December 2018, Gutenberg later introduced full site editing (FSE) in 2021, which shipped with WordPress 5.9 in early 2022. What Does Gutenberg Do? Gutenberg is WordPress’s “block editor”, and introduces a modular approach to modifying your entire site. Edit individual content blocks on posts or pages. Add and adjust widgets. Even design your site headers, footers, and navigation with full site editing support. Each piece of content in the editor, from a paragraph to an image gallery to a headline, is its own block. And just like physical blocks, WordPress blocks can be added, arranged, and rearranged, allowing users to create media-rich content and site layouts in a visually intuitive way — and without workarounds like shortcodes or custom HTML and PHP. We’re always hard at work refining the experience, creating more and better blocks, and laying the groundwork for future phases of work. Each WordPress release includes stable features from the Gutenberg plugin, so you don’t need to install the plugin to benefit from the work being done here. Early Access Are you a tech-savvy early adopter who likes testing bleeding-edge and experimental features, and isn’t afraid to tinker with features that are still in active development? If so, this beta plugin gives you access to the latest Gutenberg features for block and full site editing, as well as a peek into what’s to come. Contributors Wanted For the adventurous and tech-savvy, the Gutenberg plugin gives you the latest and greatest feature set, so you can join us in testing and developing bleeding-edge features, playing around with blocks, and maybe get inspired to contribute or build your own blocks. Discover More User Documentation: Review the WordPress Editor documentation for detailed instructions on using the editor as an author to create posts, pages, and more. Developer Documentation: Explore the Developer Documentation for extensive tutorials, documentation, and API references on how to extend the editor. Contributors: Gutenberg is an open-source project and welcomes all contributors from code to design, from documentation to triage. See the Contributor’s Handbook for all the details on how you can help. The development hub for the Gutenberg project can be found at https://github.com/wordpress/gutenberg. Discussions for the project are on the Make Core Blog and in the #core-editor channel in Slack, including weekly meetings. If you don’t have a Slack account, you can sign up here.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C