Description

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-11T07:16:47.147Z",
  "pubdate": "2026-09-11T07:16:47.147Z",
  "executiveSummary": "The Gutenverse News WordPress plugin before version 3.3.3 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw stems from improper input sanitization, where the plugin applies an overly permissive set of allowed HTML elements to all sanitization contexts, including comment fields.\nThe vulnerability allows unauthenticated attackers to inject and store malicious JavaScript payloads within the comment queue. When an administrator views the comment queue or when a visitor views a post where the comment is approved, the injected script executes within the user's browser session. This creates a critical risk of administrative account compromise, session hijacking, and unauthorized actions performed on behalf of legitimate users. No special privileges are required for an attacker to initiate this exploit, as the attack surface is exposed via public-facing comment submission forms. The impact is significant, potentially leading to a full site compromise if administrative sessions are targeted.",
  "technicalDetails": "The root cause of this vulnerability lies in the plugin's failure to adhere to the principle of least privilege regarding input sanitization contexts. Gutenverse News extends the default WordPress allowed HTML elements to facilitate its functionality; however, it fails to constrain this expanded list to specific, intended scopes. Instead, the plugin forces these relaxed sanitization rules globally across the WordPress environment.\nWhen a user submits a comment, the application processes the input through these improperly configured sanitization filters. Because the plugin does not distinguish between comment sanitization and other secure contexts, it permits the injection of dangerous HTML tags and event attributes that are normally stripped or neutralized by WordPress core security filters. An attacker can craft a payload containing standard HTML tags integrated with JavaScript event handlers (e.g., <img src=x onerror=alert(1)> or <script> tags).\nThe attack flow begins when an unauthenticated attacker submits a comment containing the malicious payload via the WordPress comment submission endpoint. Because the plugin's sanitization logic is flawed, the payload is persisted in the database without being effectively neutralized. The execution phase occurs in two distinct scenarios: First, when an administrator navigates to the 'Comments' management dashboard to review the pending queue, the stored malicious script executes in the administrator's authenticated browser context. This allows the attacker to perform actions such as creating new administrative accounts, modifying site settings, or redirecting the admin to malicious domains. Second, if the comment is approved, the payload persists on the public-facing post page, executing in the browser of any visitor who accesses the page. This facilitates widespread site-wide XSS, potentially impacting site integrity and user trust. The lack of contextual awareness during the sanitization process effectively bypasses WordPress's standard security mitigations, transforming a routine input field into a vector for persistent, client-side code execution. Since the vulnerability is located in the plugin's core sanitization handling, it affects all WordPress installations using versions of Gutenverse News prior to 3.3.3."
}