CVE-2026-106469

Deferred Deferred - Pending Action

Gutenverse Form SVG Icon Stored XSS Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: WPScan

Description

The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in the session of any user who views or previews the affected form, such as an administrator reviewing a pending post.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106469

EUVD

EUVD-2026-100884

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Gutenverse	Form 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Gutenverse Form WordPress plugin before version 3.0.11. It occurs because the plugin does not sanitize SVG icon markup stored in form blocks. Authenticated users with Contributor-level access or higher can inject malicious SVG content containing JavaScript. When viewed by others, such as administrators, the JavaScript executes in their session.

Detection Guidance

Check WordPress installations for the Gutenverse Form plugin versions prior to 3.0.11. Inspect form blocks for SVG icons containing JavaScript or unusual markup. Review server logs for suspicious form submissions or unauthorized actions.

Impact Analysis

An attacker with Contributor access or higher could inject malicious JavaScript into SVG icons in forms. When an administrator views or previews the form, the script runs in their browser session. This could lead to unauthorized actions, data theft, or session hijacking on the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations using the vulnerable plugin may face compliance violations if user data is compromised through this exploit.

Mitigation Strategies

Update the Gutenverse Form plugin to version 3.0.11 or later immediately. Remove any untrusted SVG icons from form blocks. Restrict Contributor-level and higher user roles to trusted individuals only.

Hi! I’m here to help you understand CVE-2026-106469. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70