What is the CVSS score of CVE-2026-85677?

CVE-2026-85677 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Gutenverse News are affected by CVE-2026-85677?

Gutenverse News WordPress plugin versions before 3.3.3 contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through comment…. A patch is available.

Is there a public PoC exploit available for CVE-2026-85677?

Yes, a public proof-of-concept exploit is available for CVE-2026-85677. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-85677?

Publicly available exploit code exists for this vulnerability; immediate action is required. Within 24 hours: inventory all WordPress installations to identify systems using Gutenverse News and verify current plugin version; immediately deactivate the plugin on any instance running version 3.3.2 or earlier. Within 7 days: update Gutenverse News to version 3.3.3 or later, then reactivate the plugin; manually review the comment moderation queue for any suspicious or unexpected submissions that may contain malicious payloads. Within 30 days: conduct a full audit of WordPress admin account login activity and configuration changes around the time the plugin was active to identify any compromise; review site access logs for anomalous visitor behavior.

Gutenverse News CVE-2026-85677

EUVD-2026-75966 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-09-11 WPScan

GHSA-wg2r-37mx-8x45

WordPress XSS Gutenverse News Unknown

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered stored XSS, no auth required, low complexity; UI:R because victim must load the comment page; C/I/A:H reflects admin session takeover potential.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

POC Analysis Generated

Sep 11, 2026 - 15:32 vuln.today

Analysis Generated

Sep 11, 2026 - 11:25 vuln.today

CVSS changed

Sep 11, 2026 - 11:22 NVD

8.8 (HIGH)

Patch available

Sep 11, 2026 - 08:16 EUVD

CVE Published

Sep 11, 2026 - 06:00 cve.org

HIGH 8.8

CVE Published

Sep 11, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.

AnalysisAI

Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The Gutenverse News WordPress plugin version prior to 3.3.3 must be installed and active. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the attack profile: no authentication required, no special configuration, low complexity, and high impact across all three pillars once a user views the comment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the Gutenverse News plugin to version 3.3.3 or later immediately via the WordPress admin dashboard (Plugins > Updates) or via WP-CLI with 'wp plugin update gutenverse-news'. … Detailed patch versions, workarounds, and compensating controls in full report.