The vulnerability allows authenticated users with contributor‑level access or higher to store malicious scripts in the separatorIconSVG field of the Gutenverse plugin. The stored script is rendered on pages that use the affected block, executing automatically in the victim’s browser. This can lead to defacement, theft of session cookies, authorization escalation, or delivery of malware to site visitors.

WordPress sites that have installed the Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin version 3.5.3 or earlier. Any user with contributor privileges on those sites can craft the injection. The issue does not affect older or newer plugin versions.

With a CVSS score of 6.4 the vulnerability is of moderate severity; the EPSS score is not available, and it is not currently listed in CISA KEV. The exploit requires local authenticated access, so attackers must first gain contributor‑level credentials. Once in place, they can embed arbitrary JavaScript that will run automatically when regular visitors view the affected page, enabling phishing, session hijacking or other malicious actions. Because many WordPress sites rely on this plugin, the overall risk is notable for sites that use contributor accounts on the affected plugin version.