CVE-2026-1395

OVERVIEW The Gutentools WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the Post Slider block's block_id attribute affecting all versions through 1.1.3. The flaw stems from inadequate input sanitization and output escaping, compounded by a custom unescaping routine that reintroduces malicious characters. Authenticated attackers with Contributor-level or higher privileges can inject arbitrary JavaScript that executes when users access affected pages. SEVERITY This vulnerability carries a CVSS 3.1 score of 6.4 (Medium) with a network-based attack vector requiring low complexity and low privileges to exploit. The attack does not require user interaction from the attacker but results in cross-site scope impact with limited confidentiality and integrity compromise. The FAUCET Risk Score of 44.0/100 indicates moderate concern, though the extremely low EPSS score (0.00011) suggests current exploitation probability is negligible. EXPLOITATION STATUS This vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. There is no evidence of active exploitation or publicly available exploit code at this time. However, the straightforward nature of the vulnerability and the accessibility of Contributor-level accounts in typical WordPress installations warrant monitoring and timely patching of the Gutentools plugin.