The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's

Published September 11, 2026 CVE-2026-85677

Gutenverse News can let anyone plant code inside a WordPress comment. The code runs when an administrator reviews it or visitors see an approved comment.

Severity
HighCVSS 3.1 · 8.8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Fix
Fixed in 3.3.3
Affected versions
before 3.3.3
Weakness
CWE-79Cross-site Scripting (XSS)
Exploit likelihood
0.17% in 30 daysEPSS, higher than 7% of known flaws
Affects
Gutenverse News
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75966ENISA vulnerability database

How it works

  • An attacker submits a comment containing JavaScript without needing an account.
  • The plugin mistakenly allows extra HTML in untrusted comments across every cleaning context.
  • WordPress then stores the attacker's code instead of removing it.
  • Reviewing the comment runs the code in an administrator's browser.
  • Approving it also exposes visitors viewing that post.

What to do

Check the installed Gutenverse News version if your WordPress site uses the plugin. Compare it with 3.3.3 using the WPScan advisory. Treat any versions older than 3.3.3 as affected.

Update Gutenverse News to version 3.3.3 or later. Verify the installed version after the update finishes.

Technical details

CVE-2026-85677 is stored cross-site scripting through WordPress comment content. Gutenverse News broadens WordPress's allowed HTML across every cleaning context, including untrusted comments. No login is required to submit the code. It executes when an administrator reviews the comment queue or when visitors open a post containing an approved comment.

Version 3.3.3 fixes the flaw.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source