The Gutenverse Form plugin contains a stored cross‑site scripting flaw that allows an authenticated user with Author-level access or higher to upload an SVG file containing malicious JavaScript. When the file is viewed, the script runs in the victim’s browser, enabling the attacker to steal credentials, deface the site, or perform other client‑side attacks. The vulnerability stems from the plugin adding SVG to the allowed MIME types without sanitizing the file contents.

All releases of the Jegstudio Gutenverse Form – Contact Form Builder, Booking, Reservation, Subscribe for Block Editor plugin for WordPress up to and including version 2.3.2 are affected.

The flaw has a CVSS score of 6.4 indicating moderate severity. The EPSS score is below 1 %, suggesting a low but non‑zero likelihood of exploitation. It is not listed in CISA’s KEV catalog. Attackers must first authenticate to the site with Author or higher privileges, upload a malicious SVG, and then wait for other site visitors to view the file to trigger the JavaScript.