Plugin icon

Gutenberg

gutenberg

Vulnerabilities:

11

Last Updated:

September 7, 2026

Active Installs:

400000

Published
Title
Fixed in
CVSS
Published
2026-08-06
Title
WP 7.0.x - Unauthenticated Password Protected Post Comment Disclosure via Gutenberg Latest Comments Block
Fixed in
Fixed in 23.7.1
CVSS
5.3 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Content Block
Fixed in
Fixed in 23.7.1
CVSS
6.8 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Date Block
Fixed in
Fixed in 23.7.1
CVSS
6.8 (medium)
Published
2025-10-25
Title
Gutenberg 21.7 - 21.8 - Contributor+ Stored XSS
Fixed in
Fixed in 21.9.0
CVSS
6.4 (medium)
Published
2024-06-24
Title
WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block
Fixed in
Fixed in 18.6.1
CVSS
6.4 (medium)
Published
2024-04-09
Title
Gutenberg 12.9.0 - 18.0.0 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
Fixed in
Fixed in 18.01
CVSS
6.4 (medium)
Published
2023-11-17
Title
Gutenberg < 16.8.1 - Contributor+ Stored XSS
Fixed in
Fixed in 16.8.1
CVSS
5.9 (medium)
Published
2023-10-13
Title
Gutenberg < 16.8.1 - Contributor+ Stored XSS via Navigation Links Block
Fixed in
Fixed in 16.8.1
CVSS
5.9 (medium)
Published
2022-10-17
Title
Gutenberg < 14.3.1 - Multiple Stored XSS
Fixed in
Fixed in 14.3.1
CVSS
3.4 (low)
Published
2022-03-11
Title
WordPress < 5.9.2 / Gutenberg < 12.7.2 - Prototype Pollution via Gutenberg’s wordpress/url package
Fixed in
Fixed in 12.7.2
CVSS
5.6 (medium)
Published
2022-03-11
Title
WordPress (5.9-5.9.1) / Gutenberg (9.8.0-12.7.1) - Contributor+ Stored Cross-Site Scripting
Fixed in
Fixed in 12.7.2
CVSS
6.8 (medium)