Gutenverse News
Monthly
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.