CVE-2026-85677: Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gutenverse Newsto a version that resolves this vulnerability.Fixed in 3.3.3
Event History
Frequently Asked Questions
Who can exploit this issue and who is at risk from the stored payload?
An unauthenticated user can submit a malicious comment. The JavaScript can execute for an administrator reviewing the comment queue and, if the comment is approved, for visitors viewing the affected post.
Are pending comments sufficient to trigger the issue?
Yes. A malicious payload stored in a pending comment can execute when an administrator reviews the comment queue; approval is only needed for the payload to affect post visitors.
Which plugin versions are affected?
Gutenverse News versions before 3.3.3 are affected. Updating to version 3.3.3 or later addresses the described issue.