CVE-2026-92396: medium-severity vulnerability in ShopEngine Gutenberg WooCommerce Builder…
Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.8epss 0.2%
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · ShopEngine Gutenberg WooCommerce Builder Blocks Addonpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/f7db6391-4873-4de9-b300-456f3c9b7146/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.