What’s Vulnerable › Vulnerabilities
CVE-2026-85677: Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-11 · updated 2026-09-11
- Weakness: CWE-79
Description
The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.
Affected products
- Gutenverse News: before 3.3.3 — fixed in 3.3.3
How to fix
Upgrade to a fixed version: Gutenverse News 3.3.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-85677 or the next vulnerability affects your stack