PT-2026-1763 · WordPress · Gutenverse Form

Andrea Bocchetti · Publicado 2026-01-08 · Atualizado 2026-01-08 · CVE-2025-14984

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gutenverse Form plugin for WordPress versions prior to 2.3.3

Description The Gutenverse Form plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. The plugin’s framework component allows SVG files through the upload mimes filter without sanitizing the SVG file contents. This allows authenticated attackers with Author-level access or higher to upload SVG files containing malicious JavaScript. When these files are viewed, the malicious JavaScript executes in the victim’s browser, potentially leading to arbitrary JavaScript execution.

Recommendations Update the Gutenverse Form plugin to version 2.3.3 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-14984

Produtos afetados

Gutenverse Form

Referências · 6

• https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L837 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14984 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/792fa6cb-e55a-4f68-b8a8-9039fb1ff694?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L169 · Nota
• https://plugins.trac.wordpress.org/changeset/3427504/gutenverse-form/trunk/lib/framework/includes/class-init.php?old=3395520&old_path=gutenverse-form%2Ftrunk%2Flib%2Fframework%2Fincludes%2Fclass-init.php · Nota
• https://twitter.com/CVEnew/status/2009201081415286866 · Publicação no Twitter