Gutenverse Form – Contact Form Builder, Block Form & Booking Form <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Icon Block Attributes
- ID
- WPSEC-2026-0614
- Plugin
- Gutenverse Form – Contact Form Builder, Block Form & Booking Form (gutenverse-form)
- Affected
- from 2.6.0 before 3.0.11
- Remediation
- Update to 3.0.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-08
- Attack surface
- Gutenverse Form – Contact Form Builder, Block Form & Booking Form on WPSec AttackSurface
- Fix released
- Published
Description
The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG icon attributes of the Form Input Select block (dropDownIconOpenSVG and dropDownIconCloseSVG) and the Form Notice block (iconSuccessSVG and iconErrorSVG) in versions 2.6.0 up to, and including, 3.0.10. This is due to insufficient validation of user-supplied base64-encoded SVG data, which is decoded and inserted into the page as markup. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0614/
- https://plugins.svn.wordpress.org/gutenverse-form/tags/3.0.11/
- https://wordpress.org/plugins/gutenverse-form/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS