Threat Database

Threat Entry Updated 2026-11-12

Gutenverse Form - Security Vulnerability (CVE-2026-124018)

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an…

PLUGIN Gutenverse Form

CVE-2026-124018

MEDIUM CVSS 5.3 2026-11-12

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

Gutenverse Form - Cross-Site Scripting (XSS) (CVE-2026-56040)

Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form

PLUGIN Gutenverse Form

CVE-2026-56040

HIGH CVSS 7.1 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Gutenverse Form - Arbitrary File Upload (CVE-2025-14984)

The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. This is due to the plugin's framework component adding SVG to the allowed MIME types via the upload_mimes filter without implementing any sanitization of SVG file contents. This makes it possible for authenticated attackers, with Author-level access and above, to upload SVG files containing malicious JavaScript that executes when the file is viewed, leading to arbitrary JavaScript execution in victims' browsers.

PLUGIN Gutenverse Form

CVE-2025-14984

MEDIUM CVSS 6.4 2026-01-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Gutenverse Form - Broken Access Control (CVE-2025-68511)

Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse Form: from n/a through

PLUGIN Gutenverse Form

CVE-2025-68511

MEDIUM CVSS 6.5 2025-12-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Gutenverse Form - Broken Access Control (CVE-2025-66079)

Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse Form: from n/a through

PLUGIN Gutenverse Form

CVE-2025-66079

MEDIUM CVSS 6.5 2025-11-21

Risk Score

Open Full Technical Breakdown