CVE-2026-106469: Gutenverse Form 0 to before 3.0.11

Affected technology

Gutenverse Form · 0 to before 3.0.11
Vendor not specified by the source

Description’s affected range: before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser

Component: Not specified by the source

What an attacker can do

Authenticated users with Contributor-level access and above can store malicious SVG that executes JavaScript in the session of any user who views or previews the affected form, such as an administrator reviewing a pending post.