Gutenverse Form
Monthly
Stored cross-site scripting in the Gutenverse Form WordPress plugin before 3.0.11 lets authenticated users with Contributor-level access or higher plant malicious SVG icon markup in a form block, which the plugin decodes and inserts into the page without sanitization so the script executes in the browser session of any user who views or previews the form - typically an administrator reviewing a pending post. Exploitation is conditional: it requires the vulnerable plugin with an SVG-icon form block, an attacker-controlled Contributor account (open self-registration or an otherwise obtained account), and a higher-privileged victim who renders the form, so publicly available exploit code exists but the payload stays inert until a privileged session triggers it. The vendor patch is available in 3.0.11, EPSS is very low at 0.19% (8th percentile), and there is no indication of confirmed active exploitation (no CISA KEV listing), making this a moderate, real-but-conditional risk rather than an urgent emergency.
Stored cross-site scripting in the Gutenverse Form WordPress plugin before 3.0.11 lets authenticated users with Contributor-level access or higher plant malicious SVG icon markup in a form block, which the plugin decodes and inserts into the page without sanitization so the script executes in the browser session of any user who views or previews the form - typically an administrator reviewing a pending post. Exploitation is conditional: it requires the vulnerable plugin with an SVG-icon form block, an attacker-controlled Contributor account (open self-registration or an otherwise obtained account), and a higher-privileged victim who renders the form, so publicly available exploit code exists but the payload stays inert until a privileged session triggers it. The vendor patch is available in 3.0.11, EPSS is very low at 0.19% (8th percentile), and there is no indication of confirmed active exploitation (no CISA KEV listing), making this a moderate, real-but-conditional risk rather than an urgent emergency.