Gutenverse – WordPress Blocks, Page Builder & Site Editor

Gutenverse – WordPress Blocks, Page Builder & Site Editor has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 11 of the records (79%). Other recurring categories include Missing Authorization, Server-Side Request Forgery (SSRF).

Every one of the 14 issues recorded for Gutenverse – WordPress Blocks, Page Builder & Site Editor has a vendor fix available, so running the current release closes all known holes.

11 independent researchers contributed these findings, most of them (3) reported by Osvaldo Noe Gonzalez Del Rio (Os). Gutenverse – WordPress Blocks, Page Builder & Site Editor is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891009.02.2022Today19.06.20235.3Gutenverse <= 1.8.5 - Missing Authorization via 'data/update' API Endpoint CVSS 5.3 · 19.06.202312.04.20246.4Gutenverse <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 12.04.202419.07.20246.4Gutenverse <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 19.07.202426.08.20246.4Gutenverse <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 26.08.202428.04.20256.4Gutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block CVSS 6.4 · 28.04.202505.08.20256.4Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks CVSS 6.4 · 05.08.202528.11.20254.3Gutenverse <= 3.2.1 - Missing Authorization CVSS 4.3 · 28.11.202503.04.20266.4Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad' CVSS 6.4 · 03.04.202604.05.20266.4Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG' CVSS 6.4 · 04.05.20266.4Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl' CVSS 6.4 · 04.05.202626.05.20266.1Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter CVSS 6.1 · 26.05.202626.06.20264.4Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter CVSS 4.4 · 26.06.202624.08.20266.4Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute CVSS 6.4 · 24.08.202625.08.20266.4Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks CVSS 6.4 · 25.08.2026

Strategic Overview

Avg CVSSMedium
6.0/ 10
Patch Coverage100%
Open

0

Fixed

14

Get automatic notifications for all Gutenverse – WordPress Blocks, Page Builder & Site Editor vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-3002

Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks

Read the full analysis

Vulnerability Records

14 records
2026-08-25 00:00CVE-2026-3002
6.4
Medium
Osvaldo Noe Gonzalez Del Rio (Os)Yes
2026-08-24 14:33CVE-2026-19943
6.4
Medium
Wordfence PRISMYes
2026-06-26 17:52CVE-2026-12399
4.4
Medium
R4mbbYes
2026-05-26 00:00CVE-2026-3001
6.1
Medium
Osvaldo Noe Gonzalez Del Rio (Os)Yes
2026-05-04 14:51CVE-2026-2948
6.4
Medium
Osvaldo Noe Gonzalez Del Rio (Os)Yes
2026-05-04 14:22CVE-2026-2868
6.4
Medium
Athiwat Tiprasaharn (Jitlada)Yes
2026-04-03 13:45CVE-2026-2924
6.4
Medium
Muhammad Yudha - DJYes
2025-11-28 00:00CVE-2025-66065
4.3
Medium
Denver JacksonYes
2025-08-05 17:41CVE-2025-7727
6.4
Medium
zer0gh0stYes
2025-04-28 17:26CVE-2025-2893
6.4
Medium
WebbernautYes
Showing 1–10 of 14 reports
Gutenverse – WordPress Blocks, Page Builder & Site Editor banner
Latestv4.0.7

Gutenverse – WordPress Blocks, Page Builder & Site Editor

Jegstudio

Author

Jegstudio

4.9(190)
98/100
Last Updated
2026-09-04 (9d ago)
Active Installs
20,000+
Downloads
1,457,586
Requires WP
5.9+
Requires PHP
7.0+
Tested up to
WP 7.1
Created
2022-02-09 (5y ago)

Gutenverse is a WordPress blocks plugin, page builder, and website builder for the native Block Editor and Site Editor. Create fast, responsive websites without code using 57 blocks, 600+ templates, global styles, responsive controls, popup builder tools, and block theme support. Build landing pages, business websites, blogs, portfolios, headers, footers, archive templates, single post templates, popups, and full site designs with WordPress blocks in the native Block Editor and Site Editor. Use Gutenverse when you want a lightweight page builder experience that extends WordPress, Gutenberg, and the Site Editor instead of replacing the editor. Why Choose Gutenverse Build pages and websites with WordPress blocks Use page builder controls inside the native Block Editor Create full site layouts with the WordPress Site Editor Start from 600+ starter templates, sections, and layouts Use block themes and Full Site Editing (FSE) Design responsive pages for desktop, tablet, and mobile Build popups, landing pages, headers, footers, and post templates Keep the editing workflow close to WordPress core Key Features 57 WordPress blocks for the Block Editor 600+ ready-to-import starter templates and sections WordPress Site Editor and block theme support Page builder controls inside the native Block Editor Popup builder tools Responsive editing controls and custom breakpoints Global color and global font controls Flexible layout blocks for sections, containers, and columns Block management to enable or disable unused blocks Icon library with 100+ icons Advanced styling controls for spacing, background, border, typography, visibility, and animation Lightweight, performance-focused website building experience WordPress Blocks Included Gutenverse includes layout blocks, content blocks, design blocks, post blocks, and site building blocks for WordPress. Block categories include: Layout and wrapper blocks: Container, Section, Column, Flexible Wrapper, and Popup Builder Content and design blocks: Heading, Button, Image, Gallery, Tabs, Accordion, Icon Box, Team, Testimonials, Google Maps, and more Post and site blocks: Post Block, Post Title, Post Content, Post Featured Image, Archive Title, and Search Result Title Explore the full block list at Gutenverse Blocks. Template Library Gutenverse includes 600+ starter templates, layouts, and sections for faster website creation. Start from prebuilt designs, then customize each section with WordPress blocks, responsive controls, global colors, and global fonts. Template types include landing pages, business websites, portfolio layouts, content sections, headers, footers, archive layouts, single post layouts, and full site templates. Built For The WordPress Site Editor Gutenverse works with the WordPress Site Editor, block themes, and Full Site Editing. You can create and customize site parts such as headers, footers, archive pages, and single post templates using WordPress blocks. For a ready-made block theme, try Unibiz. Free And Pro Features The free version of Gutenverse includes the core WordPress blocks, template library access, responsive controls, global styles, layout tools, and popup builder features needed to build a complete WordPress website. Gutenverse Pro adds advanced blocks, templates, form builder tools, popup options, dynamic data, display conditions, custom fonts, premium templates, and advanced site building features. Use of 3rd-Party Services Gutenverse may connect to the following third-party services when you enable or use related features. Gutenverse.com The Gutenverse dashboard may show optional links, template/library access, theme data, documentation, support, banners, license checks, or newsletter subscription features from gutenverse.com. Newsletter data is sent only when you manually submit your email address. Website: https://gutenverse.com/ Terms: https://gutenverse.com/terms-and-conditions/ Google Maps If you add the Google Maps block, the map may load content from Google Maps. Service endpoint: https://maps.google.com/maps Privacy Policy: https://policies.google.com/privacy Terms of Service: https://policies.google.com/terms Google Fonts Some Gutenverse dashboard screens may load Google Fonts for dashboard typography. Service endpoint: https://fonts.googleapis.com/ Privacy Policy: https://policies.google.com/privacy Terms of Service: https://policies.google.com/terms Social Share Links If you use social sharing blocks, visitors may open external social sharing URLs when they click a share button.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C