Gutenverse – WordPress Blocks, Page Builder & Site Editor Security & Risk Analysis
wordpress.org/plugins/gutenverseWordPress blocks, page builder, and website builder for the Block Editor and Site Editor with templates, popups, and block themes.
Is Gutenverse – WordPress Blocks, Page Builder & Site Editor Safe to Use in 2026?
Generally Safe
Score 95/100Gutenverse – WordPress Blocks, Page Builder & Site Editor has a strong security track record. Known vulnerabilities have been patched promptly. It's a solid choice for most WordPress installations.
The Gutenverse plugin v3.5.0 exhibits a mixed security posture. While it demonstrates good practices in areas like SQL query sanitization and output escaping, a significant concern arises from its attack surface. Four AJAX handlers are present, with all four lacking proper authorization checks. This represents a substantial risk, as any unauthenticated user could potentially trigger these handlers, leading to unintended actions or information disclosure.
The vulnerability history of Gutenverse is a major red flag. With seven known medium-severity vulnerabilities, including Cross-site Scripting and Missing Authorization, this indicates a recurring pattern of security weaknesses. Although no vulnerabilities are currently unpatched, the historical prevalence suggests a lack of robust security development practices or thorough security auditing. The lack of critical or high-severity vulnerabilities in the static analysis is a positive sign, as is the proper use of prepared statements for SQL queries. However, the unprotected AJAX endpoints combined with the historical vulnerability data present a notable risk that requires immediate attention.
Key Concerns
- Unprotected AJAX handlers
- Multiple past medium severity vulnerabilities
- Missing authorization checks on AJAX
Gutenverse – WordPress Blocks, Page Builder & Site Editor Security Vulnerabilities
CVEs by Year
Severity Breakdown
12 total CVEs
Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter
Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'
Gutenverse <= 3.2.1 - Missing Authorization
Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks
Gutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block
Gutenverse <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Gutenverse <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Gutenverse <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Gutenverse <= 1.8.5 - Missing Authorization via 'data/update' API Endpoint
Gutenverse – WordPress Blocks, Page Builder & Site Editor Release Timeline
Gutenverse – WordPress Blocks, Page Builder & Site Editor Code Analysis
Output Escaping
Gutenverse – WordPress Blocks, Page Builder & Site Editor Attack Surface
AJAX Handlers 4
REST API Routes 1
WordPress Hooks 34
Maintenance & Trust
Gutenverse – WordPress Blocks, Page Builder & Site Editor Maintenance & Trust
Maintenance Signals
Community Trust
Gutenverse – WordPress Blocks, Page Builder & Site Editor Alternatives
Spectra Blocks – AI Website Builder for the Block Editor
spectra-blocks
Build a full website with AI, then edit every block natively in Gutenberg. No new editor to learn, no lock-in.
aThemes Blocks
athemes-blocks
Extend the Gutenberg Block Editor with additional functionality.
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
gutenkit-blocks-addon
GutenKit – Ultimate no-code Gutenberg blocks to design stunning web pages and visually stunning posts in WordPress block editor.
Kubio AI Page Builder
kubio
Using the power of AI, Kubio gives you a head start by generating a first draft of your website, which you can further customize to your liking.
BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library
blockart-blocks
Enhance the power of your WordPress editor with the dynamic Gutenberg blocks by BlockArt Blocks. Build any layout imaginable.
Gutenverse – WordPress Blocks, Page Builder & Site Editor Developer Profile
6 plugins · 49K total installs
How We Detect Gutenverse – WordPress Blocks, Page Builder & Site Editor
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/gutenverse/assets/css/gutenverse.css/wp-content/plugins/gutenverse/assets/js/gutenverse.js/wp-content/plugins/gutenverse/assets/js/gutenverse.jsgutenverse/assets/css/gutenverse.css?ver=gutenverse/assets/js/gutenverse.js?ver=HTML / DOM Fingerprints
guten-post-commentguten-elementguten-post-comment-titlecomment-titletitle-textcomment-countcomment-post-titledata-settingsgutenverse_data