{"id":"CVE-2026-121771","kind":"vulnerability","aliases":["CVE-2026-121771"],"related":[],"title":"PublishPress Gutenberg Blocks: sensitive data embedded in sent responses","description":"Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6.","summary":"PublishPress Gutenberg Blocks (advanced-gutenberg) versions through 3.7.6 insert sensitive information into data it sends, according to the NVD entry. An attacker can retrieve that embedded sensitive data.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gutenberg","package","publishpress","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the advanced-gutenberg plugin in the WordPress admin plugins list; versions through `3.7.6` are listed as affected.","fix":"- PublishPress Gutenberg Blocks (advanced-gutenberg): a fixed version above `3.7.6` is implied by the affected range, but the sources do not name it.","status":"open","published_at":"2026-11-13T13:17:55+00:00","first_seen_at":"2026-11-13T13:46:51+00:00","triaged_at":"2026-11-13T13:48:06+00:00","updated_at":"2026-11-13T13:48:06+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T13:48:06Z","model":"claude-haiku-5-5","output":{"fix":"- PublishPress Gutenberg Blocks (advanced-gutenberg): a fixed version above `3.7.6` is implied by the affected range, but the sources do not name it.","reach":"unknown","title":"PublishPress Gutenberg Blocks: sensitive data embedded in sent responses","impact":"medium","summary":"PublishPress Gutenberg Blocks (advanced-gutenberg) versions through 3.7.6 insert sensitive information into data it sends, according to the NVD entry. An attacker can retrieve that embedded sensitive data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gutenberg","publishpress"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads sensitive data embedded in responses","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121771 for the affected data, required privileges and the fixed version.","how_to_check":"- Check the installed version of the advanced-gutenberg plugin in the WordPress admin plugins list; versions through `3.7.6` are listed as affected.\n- unknown for any other check; the sources do not say which data is embedded or where.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"The sources only state that versions through 3.7.6 of the PublishPress Gutenberg Blocks plugin are affected. Sites running that WordPress plugin are the ones to look at; the sources do not say which configuration or data path is exposed, or whether an account is needed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000764,"input_tokens":4562,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121771':12A,15A '-2026':11A,14A '3.7.6':28B,76C 'accord':36B 'advanc':24B,62C 'advanced-gutenberg':23B,61C 'affect':70C 'allow':64C 'attack':42B 'block':3A,22B,60C,72C 'cve':10A,13A 'data':5A,33B,48B,55C 'data.this':68C 'embed':6A,46B,66C 'entri':40B 'gutenberg':2A,16B,21B,25B,59C,63C,71C 'inform':31B,52C 'insert':29B,49C 'issu':69C 'n/a':74C 'nvd':39B 'packag':17B 'publishpress':1A,18B,20B,58C 'respons':9A 'retriev':44B,65C 'send':35B 'sensit':4A,30B,47B,51C,67C 'sent':8A,54C 'version':26B 'vulner':56C 'wordpress':19B","nicknames":[],"mitigations":[],"who_affected":"The sources only state that versions through 3.7.6 of the PublishPress Gutenberg Blocks plugin are affected. Sites running that WordPress plugin are the ones to look at; the sources do not say which configuration or data path is exposed, or whether an account is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gutenberg","medium","package","publishpress","wordpress"],"campaign_type":null,"search_a":"'-121771':12A,15A '-2026':11A,14A 'block':3A 'cve':10A,13A 'data':5A 'embed':6A 'gutenberg':2A 'publishpress':1A 'respons':9A 'sensit':4A 'sent':8A","search_b":"'3.7.6':28B 'accord':36B 'advanc':24B 'advanced-gutenberg':23B 'attack':42B 'block':22B 'data':33B,48B 'embed':46B 'entri':40B 'gutenberg':16B,21B,25B 'inform':31B 'insert':29B 'nvd':39B 'packag':17B 'publishpress':18B,20B 'retriev':44B 'send':35B 'sensit':30B,47B 'version':26B 'wordpress':19B","search_c":"'3.7.6':76C 'advanc':62C 'advanced-gutenberg':61C 'affect':70C 'allow':64C 'block':60C,72C 'data':55C 'data.this':68C 'embed':66C 'gutenberg':59C,63C,71C 'inform':52C 'insert':49C 'issu':69C 'n/a':74C 'publishpress':58C 'retriev':65C 'sensit':51C,67C 'sent':54C 'vulner':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T13:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121771","severity":null,"published_at":"2026-11-13T13:17:55+00:00","modified_at":"2026-11-13T13:17:55+00:00","first_seen_at":"2026-11-13T13:46:51+00:00","fetched_at":"2026-11-13T13:46:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}