The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin contains an insufficiently sanitized and escaped HTML data attribute processing mechanism that allows an authenticated user with Contributor privileges or higher to insert arbitrary JavaScript into the HTML of a page. When a user views that page, the injected code is executed in the victim’s browser, which can be used to steal session cookies, deface UI, or perform other client‑side malicious actions. The vulnerability directly exploits input validation weaknesses classified as CWE‑79 and compromises the integrity of the content delivered to users.

All WordPress installations running the Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin version 3.4.8 or earlier are affected. The flaw exists in every widget that uses HTML data attributes to store custom settings and does not apply to later releases beyond version 3.4.8.

The CVSS score of 6.4 indicates a moderately high severity. The EPSS score of less than 1% suggests that exploitation is likely uncommon at present, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread attacks. Notwithstanding the low exploit probability, the requirement for only Contributor‑level access means that many sites are potentially at risk, as contributors are commonly added for content creation. An attacker could craft malicious content that, once published, will run automatically in the browsers of all users who view the page, providing a vehicle for cookie theft, defacement, or other client‑side abuse.