CVE-2026-92746

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core wp_kses_post sanitization does not mitigate this vulnerability because the payload is stored inside a Gutenberg block delimiter comment rather than as a raw HTML tag, and is only rendered as exploitable HTML at the PHP render stage.

• CWE-79

• https://plugins.trac.wordpress.org/browser/gutenverse/tags/4.0.8/includes/block/class-post-comment.php#L51
• https://plugins.trac.wordpress.org/browser/gutenverse/tags/4.0.8/includes/block/class-post-comment.php#L80
• https://plugins.trac.wordpress.org/changeset/3710420/gutenverse/trunk/includes/block/class-post-comment.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e35f9e09-c386-4e37-9d81-8dd2863457ac?source=cve

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92720Kubero through 3.1.1 fails to apply authentication guards to…9.1
• CVE-2026-92729SigNoz versions 0.88.0 through 0.141.0 fail to apply authori…8.2
• CVE-2026-9273The Membership Plugin – Kadence Memberships plugin for WordP…9.3
• CVE-2026-92730LimeSurvey Community Edition 7.0.14 contains a reflected cro…7.4
• CVE-2026-9274This vulnerability exists in CP Plus Wi-Fi Camera due to imp…5.2
• CVE-2026-92745A flaw was found in cockpit-machines. This vulnerability all…5
• CVE-2026-92747A flaw was found in `cockpit-machines`. This vulnerability a…5
• CVE-2026-92748BC Security Empire before 6.7.1 fails to validate the multip…8.8
• CVE-2026-92749SafeLine through 9.4.1 derives the management console sessio…8.1
• CVE-2026-92750Harness through 3.3.0 omits access control validation in the…6.5
• CVE-2026-92751CMAK through 3.0.0.6 fails to install a cross-site request f…8.1
• CVE-2026-92752metasfresh DocumentAttachmentsRestController and CommentsRes…8.3