The vulnerability is an unauthenticated Cross Site Scripting flaw that affects WordPress.com’s Gutenverse Form plugin versions up to 2.4.7. The flaw allows the injection of malicious script content into form fields, which is then rendered on the site; the impact is the execution of that code in visitors’ browsers. The extent of this impact is inferred from the typical behavior of XSS vulnerabilities, as the description does not explicitly state consequences such as session hijacking or phishing.

Affected are WordPress.com installations running the Gutenverse Form plugin through version 2.4.7 inclusive; any site using an older release of the plugin is vulnerable, while upgrades to 2.5.0 or later are considered safe.

This vulnerability carries a CVSS base score of 7.1, classifying it as high severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description of unauthenticated XSS: an attacker can exploit the plugin by submitting payloads that are not sanitized, and because the flaw operates on data submitted by any visitor, compromise can occur on a per‑visit basis or through stored payloads that persist on the site.