PT-2026-1763 · WordPress · Gutenverse Form

Andrea Bocchetti · Published 2026-01-08 · Updated 2026-01-08 · CVE-2025-14984

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gutenverse Form plugin for WordPress versions prior to 2.3.3

Description The Gutenverse Form plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. The plugin’s framework component allows SVG files through the upload mimes filter without sanitizing the SVG file contents. This allows authenticated attackers with Author-level access or higher to upload SVG files containing malicious JavaScript. When these files are viewed, the malicious JavaScript executes in the victim’s browser, potentially leading to arbitrary JavaScript execution.

Recommendations Update the Gutenverse Form plugin to version 2.3.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14984

Affected Products

Gutenverse Form

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14984 · Security Note
• https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L837 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/792fa6cb-e55a-4f68-b8a8-9039fb1ff694?source=cve · Note
• https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L169 · Note
• https://plugins.trac.wordpress.org/changeset/3427504/gutenverse-form/trunk/lib/framework/includes/class-init.php?old=3395520&old_path=gutenverse-form%2Ftrunk%2Flib%2Fframework%2Fincludes%2Fclass-init.php · Note
• https://twitter.com/CVEnew/status/2009201081415286866 · Twitter Post