GCVE - cpe:2.3:a:gutentools:gutentools:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gutentools:gutentools:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Gutentools (`ab6a7e45-bf90-5897-991d-ee0d9fad59ff`)
Product	Gutentools (`ba6c2a54-d4b2-5fcb-b948-881115a8e288`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-1395`	vulnerable	2026-06-08 07:49:08.484779	Gutentools <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes MEDIUM (6.4) The Gutentools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Slider block's block_id attribute in all versions up to, and including, 1.1.3. This is due to insufficient input sanitization and output escaping combined with a custom unescaping routine that reintroduces dangerous characters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2026-04-22T09:27:20.476Z Updated: 2026-04-22T12:05:44.174Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/b2683b4e-b993-4c84-b7cc-a2cb511b4097?source=cve https://plugins.trac.wordpress.org/browser/gutentools/trunk/core/blocks/post-slider.php#L232 https://plugins.trac.wordpress.org/browser/gutentools/tags/1.1.3/core/blocks/post-slider.php#L232 https://plugins.trac.wordpress.org/browser/gutentools/trunk/core/gutentools_block.php#L123 https://plugins.trac.wordpress.org/changeset/3476597/gutentools/trunk/core/blocks/post-slider.php	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.