The vulnerability resides in the Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor WordPress plugin. Versions 3.5.5 and earlier allow an attacker with contributor‑level or higher access to embed malicious scripts within a block’s HTML. When a user opens the affected page, the stored script executes in the user’s browser, enabling data theft or session hijacking. This aligns with CWE‑79, a classic client‑side injection flaw.

WordPress sites running the Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin with a version of 3.5.5 or older are affected. The plugin is listed as gutentor. Any site using this plugin can be impacted if it has not been upgraded beyond the stated vulnerability window.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests a very low exploitation probability at present, and the vulnerability is not catalogued in CISA KEV. Exploitation requires an authenticated user with contributor privileges or higher; thus an attacker must first gain legitimate access or social engineering a contributor. No publicly disclosed exploits are reported, making the current risk moderate but present for actively used WordPress installations.