# Gutenverse Form – Contact Form Builder, Block Form & Booking Form <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Icon Block Attributes

- **ID:** WPSEC-2026-0614
- **Plugin:** Gutenverse Form – Contact Form Builder, Block Form & Booking Form (`gutenverse-form`), https://wordpress.org/plugins/gutenverse-form/
- **Affected versions:** from 2.6.0 before 3.0.11
- **Fixed in:** 3.0.11 (Update to 3.0.11 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gutenverse-form
- **Fix released:** 2026-10-07
- **Published:** 2026-10-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0614/

## Description

The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG icon attributes of the Form Input Select block (dropDownIconOpenSVG and dropDownIconCloseSVG) and the Form Notice block (iconSuccessSVG and iconErrorSVG) in versions 2.6.0 up to, and including, 3.0.10. This is due to insufficient validation of user-supplied base64-encoded SVG data, which is decoded and inserted into the page as markup. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-0614/
- https://plugins.svn.wordpress.org/gutenverse-form/tags/3.0.11/
- https://wordpress.org/plugins/gutenverse-form/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0614/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.