CVE-2025-14984

The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. This is due to the plugin's framework component adding SVG to the allowed MIME types via the upload_mimes filter without implementing any sanitization of SVG file contents. This makes it possible for authenticated attackers, with Author-level access and above, to upload SVG files containing malicious JavaScript that executes when the file is viewed, leading to arbitrary JavaScript execution in victims' browsers.

• CWE-79

• https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L169
• https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L837
• https://plugins.trac.wordpress.org/changeset/3427504/gutenverse-form/trunk/lib/framework/includes/class-init.php?old=3395520&old_path=gutenverse-form%2Ftrunk%2Flib%2Fframework%2Fincludes%2Fclass-init.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/792fa6cb-e55a-4f68-b8a8-9039fb1ff694?source=cve

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14977The Dokan: AI Powered WooCommerce Multivendor Marketplace So…8.1
• CVE-2025-14978The PeachPay — Payments & Express Checkout for WooCommerce (…5.3
• CVE-2025-14979AirVPN Eddie on MacOS contains an insecure XPC service that …7.8
• CVE-2025-14980The BetterDocs plugin for WordPress is vulnerable to Sensiti…6.5
• CVE-2025-14982The Booking Calendar plugin for WordPress is vulnerable to M…4.3
• CVE-2025-14983The Advanced Custom Fields: Font Awesome Field plugin for Wo…6.4
• CVE-2025-14985The Alpha Blocks plugin for WordPress is vulnerable to Store…6.4
• CVE-2025-14986When frontend.enableExecuteMultiOperation is enabled, the se…1.3
• CVE-2025-14987When system.enableCrossNamespaceCommands is enabled (on by d…5.3
• CVE-2025-14988A security issue has been identified in ibaPDA that could al…10
• CVE-2025-14989A vulnerability was identified in Campcodes Complete Online …9.8
• CVE-2025-1499IBM InfoSphere Information Server 11.7 stores credential inf…6.5