The vulnerability allows an attacker who has contributor or higher access to a WordPress site to store malicious JavaScript in the imageLoad parameter of the Gutenverse plugin. The injected script is rendered when any user visits the affected page, resulting in arbitrary script execution and potential data theft or defacement. This is a classic stored XSS flaw as identified by CWE‑79.

The affected product is the Gentstudio Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress, versions up to and including 3.4.6. Any WordPress installation that is using a vulnerable version of this plugin and has users with contributor‑level permissions is at risk.

The CVSS score of 6.4 indicates a moderate severity vulnerability. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely authenticated because it requires contributor or higher access to inject the payload. The script is persisted in the database, so it will execute for all users who view the compromised page without any additional action. This elevates the risk for any site using the affected plugin.