CVE-2026-85677

The Gutenverse News WordPress plugin before 3.3.3 adds extra HTML elements to WordPress's global sanitization allowlist (KSES) without scoping them to its own intended context, so the relaxed list applies to every sanitization path on the site, including comments submitted by unauthenticated visitors. An attacker can therefore post a comment containing JavaScript-bearing HTML that passes WordPress's sanitization and is stored on the site. The injected script executes in the browser of any administrator who reviews the pending comment in the moderation queue, potentially allowing session hijacking and unauthorized admin actions, and also executes for any visitor who views the post after the comment is approved. Any WordPress site running the vulnerable plugin with unauthenticated comments enabled is affected. No public proof-of-concept, listing in CISA KEV, or confirmed in-the-wild exploitation is known at this time.

What to do: Update Gutenverse News to version 3.3.3 or later as soon as possible. Until patched, consider disabling unauthenticated comments or disabling the plugin, and review the comment queue plus existing approved comments for HTML containing script or event-handler attributes; because admins who reviewed comments may already have been targeted, check for suspicious admin activity and rotate credentials if anything looks unusual.