Executive brief
Gutenverse News is a WordPress plugin that provides news block functionality for page builders. The plugin fails to properly sanitize HTML in comment content, allowing unauthenticated users to inject malicious JavaScript into comments that executes when administrators review comments or when visitors view approved comments on posts, potentially compromising site administrator accounts and visitor browsers.
Technical details
The vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the Gutenverse News WordPress plugin before version 3.3.3. The root cause is that the plugin applies a relaxed HTML sanitization allowlist globally across all sanitization contexts, including untrusted comment content, rather than restricting it to the specific contexts it was designed for. An unauthenticated attacker can inject JavaScript into post comments, which is then stored in the database. The malicious script executes in the browser of any administrator who reviews the comment queue, and any visitor to the post after the comment is approved. No authentication is required to exploit this vulnerability, and it affects any WordPress site running the vulnerable plugin version with comments enabled.
Affected products
- Gutenverse News before 3.3.3
Timeline
- 2026-09-09: disclosed
- 2026-09-11: patched: Fixed in version 3.3.3