Gutenverse Form Vulnerabilities

The Gutenverse Form – Contact Form Builder, Block Form & Booking Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVSS:

7.2

Affected:

up to 2.4.7

Fixed in:

2.5.0

Disclosed:

Jun 24, 2026

CVE-2026-56040 on NVD →

The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. This is due to the plugin's framework component adding SVG to the allowed MIME types via the upload_mimes filter without implementing any sanitization of SVG file conten...

CVSS:

6.4

Affected:

up to 2.3.2

Fixed in:

2.4.0

Disclosed:

Jan 7, 2026

CVE-2025-14984 on NVD →

The Gutenverse Form – Contact Form Builder, Booking, Reservation, Subscribe for Block Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Contributor-level a...

CVSS:

4.3

Affected:

up to 2.3.1

Fixed in:

2.3.2

Disclosed:

Dec 20, 2025

CVE-2025-68511 on NVD →

The Gutenverse Form – Contact Form Builder, Booking, Reservation, Subscribe for Block Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with Contributor-level a...

CVSS:

4.3

Affected:

up to 2.2.0

Fixed in:

2.3.0

Disclosed:

Nov 28, 2025

CVE-2025-66079 on NVD →