CVE-2025-7727: Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks
The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7727?
CVE-2025-7727 is classified as a high severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2025-7727?
To fix CVE-2025-7727, update the Gutenverse plugin to version 3.1.1 or later.
What versions of the Gutenverse plugin are affected by CVE-2025-7727?
CVE-2025-7727 affects all versions of the Gutenverse plugin up to and including 3.1.0.
What impacts could arise from CVE-2025-7727 if exploited?
If exploited, CVE-2025-7727 could allow attackers to execute arbitrary JavaScript in the context of the affected site, potentially leading to data theft or site manipulation.
Is user input involved in the vulnerability described in CVE-2025-7727?
Yes, CVE-2025-7727 arises from insufficient input sanitization and output escaping on user-supplied attributes.