The vulnerability resides in the Gutenverse WordPress plugin’s countdown block, where user‑supplied attributes are stored without proper sanitization or escaping. An authenticated contributor or higher can inject malicious JavaScript that is later rendered on any page containing the block, leading to client‑side code execution. The weakness corresponds to CWE‑79, which describes stored XSS.

Jegstudio’s Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is affected. All releases up to and including version 2.2.1 contain the flaw, regardless of the site’s WordPress core version.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1% shows that exploit attempts are rare at present. The flaw is not listed in CISA’s KEV catalog. To exploit it an attacker must be authenticated with contributor-level or higher access and must create or edit a countdown block, embedding malicious payload that will execute whenever any user views the affected page.