Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-23 | 1 | General1 |
| 2026-04-24 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-2951-gutentor-version-3-5-5-medium-vulnerability-proof-of-concept CVE-2026-2951 #WordPress plugin #vulnerability gutentor #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof‑of‑concept for CVE‑2026‑2951 in the Gutentor WordPress plugin is linked, but no exploitation tool, live attack evidence, or patch information is provided.
CVE-2026-2951 The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, … https://www.cve.org/CVERecord?id=CVE-2026-2951
Post summary
The notification identifies a stored XSS vulnerability in the Gutentor WordPress plugin but provides no PoC, exploit code, or patch information.