CVE-2026-85677
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.
Risk Assessment
An attacker could execute malicious JavaScript in the administrator's browser, potentially leading to session or site takeover.
Recommendation
Update the Gutenverse News plugin to version 3.3.3 or later to fix the vulnerability.
Other vulnerabilities in Gutenverse News
Original NVD description (English source)
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS