Gutenverse News turns unauthenticated comments into stored XSS
Gutenverse News before 3.3.3 adds extra allowed HTML globally instead of limiting it to the intended sanitization context. An unauthenticated commenter can therefore store JavaScript that executes when an administrator reviews the comment queue and, after approval, when visitors view the post. The authoritative export does not identify the filter, HTML element, or attribute involved.
- Component
- Gutenverse News
- Plugin slug
gutenverse-news- Affected
- < 3.3.3
- Safe version
3.3.3- Published
- Sep 11, 2026
This CVE was published Sep 11, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Update Gutenverse News to 3.3.3 or later. The authoritative export marks versions below 3.3.3 affected. The application-level fix must scope the relaxed HTML allowlist to the intended trusted context and retain WordPress's normal restrictions for untrusted comments.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H