The Gutenverse plugin for WordPress contains a stored Cross‑Site Scripting weakness in its 'titleTag' block attribute; contributor‑level or higher users can embed malicious JavaScript that bypasses wp_kses_post sanitization and is preserved during storage. When a page containing the injected titleTag is rendered, the script executes for all visitors, including administrators, potentially stealing session data, performing phishing, or defacing the site.

WordPress sites running the Gutenverse plugin up to and including version 4.0.2 are affected; any installation that has contributors or higher roles is vulnerable. All releases of the plugin through 4.0.2 require an upgrade to 4.0.3 or later to remediate the flaw.

The CVSS v3 score of 6.4 reflects a high impact to confidentiality, integrity, and availability, with an authenticated network attack vector. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating limited known exploitation. Nonetheless, because contributor access is common on many sites and the stored script triggers in both frontend and backend contexts, the potential damage from a single compromised contributor is significant. The likely attack vector involves an authenticated user crafting block content that contains malicious JavaScript in the titleTag field, which then persists and executes on all page viewings.