The Gutenverse Form WordPress plugin before version 3.0.11 does not sanitize SVG markup that is stored within form blocks. An attacker with at least Contributor permissions can insert malicious SVG containing embedded JavaScript. When a user, such as an administrator examining a pending post, opens or previews the affected form, that JavaScript executes in the context of the viewing browser, potentially allowing credential theft, session hijacking, or further defacement of the site.

This vulnerability affects installations of the Gutenverse Form plugin on WordPress sites running any version earlier than 3.0.11. All contributors or higher privileged users can store the malicious SVG, so any site that uses the plugin and has such roles is impacted.

The attack vector is authenticated and requires a user with Contributor or higher rights to store the malicious SVG. Although the EPSS score is below 1 % and the vulnerability is not currently listed in the CISA KEV catalog, the consequential impact of the cross‑site scripting is high. The vulnerability is a classic stored XSS flaw (CWE‑79) and can be exploited by any authenticated user to affect the browsers of other site users who visit the injected form.