The vulnerability in Gutenverse News allows a stored cross‑site scripting attack through the elementId parameter due to a lack of input sanitization and output escaping. An authenticated user with Contributor role or higher can embed arbitrary JavaScript which will run in the browsers of any user who views the affected page. The potential impact includes theft of session cookies, defacement, or redirection to malicious sites, though these effects are inferred from typical XSS consequences. The weakness is identified as CWE‑79.

WordPress sites that have installed the Gutenverse News plugin by Jegstudio, specifically any version up to and including 1.0.4. No other products are affected according to the CNA data.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires legitimate contributor credentials, which are commonly granted on many sites, and would allow the attacker to insert persistent malicious scripts into page content. While no remote code execution is possible, the impact on confidentiality, integrity, and availability of the affected website could be substantial, though the exact damage depends on the site’s content and configuration.