SVG Injection Vulnerability in Gutenverse Form WordPress Plugin
CVE-2026-106469

Currently unrated

Key Information:

Vendor

WordPress
Status
Gutenverse Form
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-106469?

The Gutenverse Form WordPress plugin, prior to version 3.0.11, is susceptible to an SVG injection vulnerability. This occurs due to the plugin's failure to properly sanitize SVG icon markup prior to rendering it on the webpage. Authenticated users with Contributor-level access and above can exploit this weakness by storing malicious SVG code within form blocks. When other users, including administrators who are reviewing pending posts, access or preview these forms, the injected SVG can execute JavaScript in their sessions, potentially compromising their security and privacy.

Affected Version(s)

Gutenverse Form 0 < 3.0.11

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-106469 - Proof of Concept

References

https://wpscan.com/vulnerability/4cccafbb-622e-4363-ade9-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

John Ryan Albon
WPScan
.