{
 "id": "WPSEC-2026-0614",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0614/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0614/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0614/index.md",
 "title": "Gutenverse Form – Contact Form Builder, Block Form & Booking Form <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Icon Block Attributes",
 "description": "The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG icon attributes of the Form Input Select block (dropDownIconOpenSVG and dropDownIconCloseSVG) and the Form Notice block (iconSuccessSVG and iconErrorSVG) in versions 2.6.0 up to, and including, 3.0.10. This is due to insufficient validation of user-supplied base64-encoded SVG data, which is decoded and inserted into the page as markup. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
 "plugin": {
  "slug": "gutenverse-form",
  "name": "Gutenverse Form – Contact Form Builder, Block Form & Booking Form",
  "full_name": "Gutenverse Form – Contact Form Builder, Block Form & Booking Form",
  "wordpress_org": "https://wordpress.org/plugins/gutenverse-form/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gutenverse-form/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gutenverse-form"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.6.0",
    "from_inclusive": true,
    "to": "3.0.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.6.0 before 3.0.11"
  ]
 },
 "introduced_in": "2.6.0",
 "fixed_in": "3.0.11",
 "remediation": "Update to 3.0.11 or later.",
 "fix_released": "2026-10-07T06:33:42+00:00",
 "published": "2026-10-08T06:42:52+00:00",
 "updated": "2026-10-07T15:30:53.574995+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0614/",
  "https://plugins.svn.wordpress.org/gutenverse-form/tags/3.0.11/",
  "https://wordpress.org/plugins/gutenverse-form/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gutenverse-form",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-08"
 }
}