The vulnerability allows an authenticated attacker with contributor level access or higher to inject arbitrary JavaScript into Gutenverse Animated Text and Fun Fact blocks. The flaw arises from insufficient input sanitization and output escaping, a classic example of CWE-79 Stored XSS. Because the payload is stored in the database, it is rendered unsanitized whenever a visitor loads the page, potentially leading to session hijacking, defacement, or data theft.

The affected product is the Jegstudio Gutenverse plugin, which powers WordPress full‑site‑editing block addons. Every release up to and including version 3.1.0 is vulnerable; any WordPress site using these block types with those plugin versions is at risk.

The CVSS score of 6.4 indicates a moderate severity risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Exploitation requires authenticated access with contributor‑level roles or higher and involves creating or editing a block that includes malicious script code; the script is executed automatically in the browser of any visitor who views the affected page.