Gutenverse Form EUVD-2026-100884

Exploitation requires: (1) the Gutenverse Form plugin installed at a version before 3.0.11 with a form block using the SVG icon feature; (2) an authenticated account at Contributor level or higher under the attacker's control (self-registration must be open, or the account otherwise obtained); and (3) a higher-privileged user - typically an administrator reviewing a pending post - to view or preview the affected form, which triggers the unsanitized SVG decode-and-insert. Limiting factors: the attacker cannot act fully unauthenticated, the payload is inert until a victim with a more privileged session renders the form (required user interaction), and sites that disable open registration or restrict Contributor content review materially reduce exposure.

This is a moderate, authenticated stored XSS (CWE-79) in the Gutenverse Form WordPress plugin, best characterized as a real-but-conditional risk rather than an urgent emergency. The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) carries an internal inconsistency worth flagging: the description states exploitation requires only 'Contributor-level access and above,' which is a LOW-privilege WordPress role, yet the vector encodes PR:H - verify with vendor, as PR:L is more defensible and would raise the score. The vector also marks S:U (unchanged scope), but a stored payload that executes JavaScript in a separate victim's (administrator's) browser session is a classic scope-change case (S:C). EPSS is low at 0.19% (8th percentile), and the CVE is NOT on CISA KEV - there is no evidence of active exploitation. Countervailing that, publicly available exploit code exists (WPScan), lowering the skill barrier. The decisive mitigating factors are the authentication requirement (a Contributor account must exist) and required user interaction (a higher-privileged user must view or preview the malicious form). Net: prioritize patching on sites with untrusted Contributor-level accounts, but this is not a mass-exploitation, spray-and-pray threat.

An attacker who holds (or phishes/registers for) a Contributor account authors a form block embedding an SVG icon crafted with malicious markup; because the plugin decodes and inserts the SVG into the page without sanitization, the JavaScript fires in the browser of any higher-privileged user who views or previews the pending content. When an administrator reviews the attacker's pending post, the script runs in their authenticated session, enabling actions such as creating a rogue admin or planting a backdoor. Public exploit code for this flaw is available via WPScan, reducing the effort required to reproduce it.