CVE-2026-92746

Executive Summary

CVE-2026-92746 is a stored cross-site scripting (XSS) vulnerability in the Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress, affecting all versions up to and including 4.0.8. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts through the Post Comment Block’s suffixMain attribute, which are stored and later executed when a user views the injected page. The vulnerability bypasses WordPress core wp_kses_post sanitization because the payload is embedded in a Gutenberg block delimiter comment rather than as a raw HTML tag, making it exploitable at the PHP render stage.

Technical Analysis

The Gutenverse plugin provides a suite of Gutenberg blocks, including a Post Comment Block. Within this block, the suffixMain attribute is intended to allow customization of the comment section’s markup suffix. However, the plugin fails to properly sanitize input and escape output for this attribute. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting).

The description explicitly states that WordPress core’s wp_kses_post sanitization does not mitigate this issue because the payload is stored inside a Gutenberg block delimiter comment. Gutenberg blocks are serialized as HTML comments, for example <!-- wp:gutenverse/post-comment {"suffixMain":"..."} /-->. Since wp_kses_post is designed to filter raw HTML tags and attributes, it does not inspect or sanitize data stored within these comment delimiters. When the block is rendered on the front end by PHP, the plugin retrieves the suffixMain attribute value and outputs it directly into the page without proper escaping, allowing the injection of arbitrary JavaScript. The attack surface is the WordPress post editor and front-end rendering pipeline. The vulnerability requires authenticated access with Contributor-level privileges or above, which is a relatively low barrier in multi-author WordPress sites, membership sites, or any environment where untrusted users can create posts. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and changed scope (S:C), with low confidentiality and integrity impact.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies a WordPress site running the Gutenverse plugin version 4.0.8 or earlier. This can be done by inspecting the site’s HTML source for plugin paths such as /wp-content/plugins/gutenverse/, or by using scanning tools that fingerprint WordPress plugins.
2. Triggering the flaw class: The attacker authenticates with Contributor-level access (or higher) and creates or edits a post containing the Gutenverse Post Comment Block. In the block’s settings, the suffixMain attribute is set to a malicious JavaScript payload, for example "><script>alert(document.cookie)</script> or a more sophisticated script that steals session cookies or performs actions on behalf of an administrator. Because the payload is stored inside the Gutenberg block delimiter comment, it bypasses wp_kses_post sanitization.
3. Payload/execution method: When the post is saved and later viewed by any user—including administrators, editors, or unauthenticated visitors—the plugin renders the block on the front end. During PHP rendering, the suffixMain value is output without adequate escaping, causing the browser to interpret the injected script as part of the page and execute it. The execution occurs in the context of the victim’s session.
4. Post-exploitation impact: The script can steal session cookies, perform arbitrary actions in the victim’s browser (e.g., create new administrative users, modify content, redirect to phishing pages), or deliver further malware. Since the payload executes for every visitor to the injected page, it can be used to compromise privileged users such as administrators, leading to full site takeover. No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

The vulnerability allows stored XSS, which can lead to session hijacking, defacement, data theft, and full site compromise. The CVSS score is 6.4 (Medium), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The changed scope (S:C) indicates that the vulnerability can affect resources beyond the vulnerable component, such as the victim’s browser or other web applications. The low confidentiality and integrity impact reflect that while data can be read and modified, the primary risk is client-side. The attack requires low privileges (Contributor+), which are commonly granted to guest authors, forum moderators, or other semi-trusted users. The blast radius includes all users who view the injected page, potentially including site administrators. In a multi-author blog or a membership site, this could affect a large number of users. The EPSS score is not yet available, and there is no evidence of exploit in the wild or CISA KEV listing.

Detection Guidance

Sigma Rule

title: Stored XSS via Gutenverse Post Comment Block suffixMain Attribute
id: 8a9b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2026-92746 by injecting scripts into the Gutenverse suffixMain attribute
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: web
  product: wordpress
detection:
  selection:
    http.method: 'POST'
    http.url|contains: '/wp-admin/post.php'
    http.body|contains|all:
      - 'gutenverse/post-comment'
      - 'suffixMain'
    http.body|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
  condition: selection
falsepositives:
  - Legitimate use of script tags in block attributes by administrators
level: medium

YARA Rule

rule CVE_2026_92746_Gutenverse_Stored_XSS
{
    meta:
        description = "Detects Gutenverse Post Comment Block suffixMain attribute with suspicious JavaScript payloads"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-92746"
        severity = "medium"
    strings:
        $block = "wp:gutenverse/post-comment"
        $attr = "suffixMain"
        $js1 = "<script" nocase
        $js2 = "javascript:" nocase
        $js3 = "onerror=" nocase
        $js4 = "onload=" nocase
        $js5 = "alert(" nocase
        $js6 = "document.cookie" nocase
    condition:
        $block and $attr and any of ($js*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92746 Gutenverse Stored XSS Attempt via suffixMain Attribute"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/wp-admin/post.php"; http.request_body; content:"gutenverse/post-comment"; http.request_body; content:"suffixMain"; http.request_body; pcre:"/(<script|javascript:|onerror=|onload=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Elastic Detection

sequence by host.id, user.name
  [ network where network.protocol == "http" and
    http.request.method == "POST" and
    url.path == "/wp-admin/post.php" and
    http.request.body contains "gutenverse/post-comment" and
    http.request.body contains "suffixMain" and
    (http.request.body contains "<script" or
     http.request.body contains "javascript:" or
     http.request.body contains "onerror=" or
     http.request.body contains "onload=") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=wordpress
  uri_path="/wp-admin/post.php" method=POST
  [search index=web sourcetype=access_combined OR sourcetype=wordpress
   uri_path="/wp-admin/post.php" method=POST
   | fields _raw
   | search _raw="*gutenverse/post-comment*" AND _raw="*suffixMain*" AND (_raw="*<script*" OR _raw="*javascript:*" OR _raw="*onerror=*" OR _raw="*onload=*")
   | fields host, clientip, _time]
| stats count by host, clientip, uri_path
| where count > 0

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100001" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/wp-admin/post.php</field>
    <field name="method">POST</field>
    <field name="body">gutenverse/post-comment</field>
    <field name="body">suffixMain</field>
    <regex field="body">(&lt;script|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-92746: Gutenverse Stored XSS attempt via suffixMain attribute</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The NVD description states a patch exists, but no specific version or commit is provided. The following steps are recommended:

1. Immediate mitigations:

   • Disable or remove the Gutenverse plugin until a patched version is confirmed and deployed.
   • Restrict Contributor-level and higher accounts to trusted users only; review existing user roles and permissions.
   • Implement a Web Application Firewall (WAF) rule to block requests containing <script or JavaScript event handlers in POST bodies to /wp-admin/post.php, especially when the gutenverse/post-comment block is referenced.
   • Monitor for suspicious POST requests to the WordPress editor that include the suffixMain attribute and script-like content.

2. Patch/upgrade steps:

   • Check the official Gutenverse plugin repository or vendor site for a security update that addresses CVE-2026-92746. Since the patch is only claimed by a single source, verify the fix by testing in a staging environment before applying to production.
   • If an update is available, upgrade the plugin to the latest version. If no official patch is released, consider replacing the plugin with an alternative or applying a virtual patch via WAF.

3. Long-term hardening:

   • Enforce strict output escaping for all block attributes in custom WordPress plugins, using functions like esc_attr(), esc_html(), or wp_kses() with appropriate context.
   • Conduct regular security audits of third-party plugins and themes.
   • Implement Content Security Policy (CSP) headers to mitigate the impact of XSS vulnerabilities.
   • Educate content creators and contributors about the risks of pasting untrusted code into block attributes.

References

• NVD Entry for CVE-2026-92746: https://nvd.nist.gov/vuln/detail/CVE-2026-92746
• Gutenverse Plugin Official Website: https://gutenverse.com/
• WordPress Plugin Repository: https://wordpress.org/plugins/gutenverse/
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• CISA KEV Catalog: Not applicable (CVE-2026-92746 is not listed as of report date).

No known threat actor campaigns or exploit-in-the-wild evidence have been observed for this CVE.