CVE-2026-85677
Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.
| Vendor | unknown |
| Product | gutenverse news |
| Published | Sep 11, 2026 |
| Last Updated | Sep 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown gutenverse news
Be the first to know when new high vulnerabilities affecting unknown gutenverse news are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Gutenverse News
0 < 3.3.3
References
Credits
Artus KG WPScan