CVE-2026-106469
Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in the session of any user who views or previews the affected form, such as an administrator reviewing a pending post.
| Vendor | unknown |
| Product | gutenverse form |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown gutenverse form
Be the first to know when new unknown vulnerabilities affecting unknown gutenverse form are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Gutenverse Form
0 < 3.0.11
References
Credits
John Ryan Albon WPScan