CVE-2025-14984

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14984", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-19T18:47:27.464Z", "datePublished": "2026-01-08T09:20:52.204Z", "dateUpdated": "2026-04-08T17:02:07.836Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:07.836Z"}, "affected": [{"vendor": "jegstudio", "product": "Gutenverse Form \u2013 Contact Form Builder, Booking, Reservation, Subscribe for Block Editor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. This is due to the plugin's framework component adding SVG to the allowed MIME types via the upload_mimes filter without implementing any sanitization of SVG file contents. This makes it possible for authenticated attackers, with Author-level access and above, to upload SVG files containing malicious JavaScript that executes when the file is viewed, leading to arbitrary JavaScript execution in victims' browsers."}], "title": "Gutenverse Form <= 2.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/792fa6cb-e55a-4f68-b8a8-9039fb1ff694?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L837"}, {"url": "https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L169"}, {"url": "https://plugins.trac.wordpress.org/changeset/3427504/gutenverse-form/trunk/lib/framework/includes/class-init.php?old=3395520&old_path=gutenverse-form%2Ftrunk%2Flib%2Fframework%2Fincludes%2Fclass-init.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "timeline": [{"time": "2025-12-22T09:20:22.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-07T20:40:47.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T15:15:35.747245Z", "id": "CVE-2025-14984", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:15:49.752Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14984", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T15:15:35.747245Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:15:42.341Z"}}], "cna": {"title": "Gutenverse Form <= 2.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload", "credits": [{"lang": "en", "type": "finder", "value": "andrea bocchetti"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "jegstudio", "product": "Gutenverse Form \u2013 Contact Form Builder, Booking, Reservation, Subscribe for Block Editor", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.3.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-22T09:20:22.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-07T20:40:47.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/792fa6cb-e55a-4f68-b8a8-9039fb1ff694?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L837"}, {"url": "https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L169"}, {"url": "https://plugins.trac.wordpress.org/changeset/3427504/gutenverse-form/trunk/lib/framework/includes/class-init.php?old=3395520&old_path=gutenverse-form%2Ftrunk%2Flib%2Fframework%2Fincludes%2Fclass-init.php"}], "descriptions": [{"lang": "en", "value": "The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. This is due to the plugin's framework component adding SVG to the allowed MIME types via the upload_mimes filter without implementing any sanitization of SVG file contents. This makes it possible for authenticated attackers, with Author-level access and above, to upload SVG files containing malicious JavaScript that executes when the file is viewed, leading to arbitrary JavaScript execution in victims' browsers."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-08T09:20:52.204Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14984", "state": "PUBLISHED", "dateUpdated": "2026-01-08T15:15:49.752Z", "dateReserved": "2025-12-19T18:47:27.464Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-08T09:20:52.204Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Gutenverse Form \u2013 Contact Form Builder, Booking, Reservation, Subscribe for Block Editor", "vendor": "jegstudio", "versions": [{"lessThanOrEqual": "2.3.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. This is due to the plugin's framework component adding SVG to the allowed MIME types via the upload_mimes filter without implementing any sanitization of SVG file contents. This makes it possible for authenticated attackers, with Author-level access and above, to upload SVG files containing malicious JavaScript that executes when the file is viewed, leading to arbitrary JavaScript execution in victims' browsers."}, {"lang": "es", "value": "El plugin Gutenverse Form para WordPress es vulnerable a Cross-Site Scripting Almacenado mediante la carga de archivos SVG en todas las versiones hasta la 2.3.2, inclusive. Esto se debe a que el componente framework del plugin a\u00f1ade SVG a los tipos MIME permitidos a trav\u00e9s del filtro upload_mimes sin implementar ninguna sanitizaci\u00f3n del contenido de los archivos SVG. Esto hace posible que atacantes autenticados, con acceso de nivel de Autor o superior, carguen archivos SVG que contengan JavaScript malicioso que se ejecuta cuando se visualiza el archivo, lo que lleva a la ejecuci\u00f3n arbitraria de JavaScript en los navegadores de las v\u00edctimas."}], "id": "CVE-2025-14984", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14984", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T15:15:35.747245Z", "version": "2.0.3"}}]}, "published": "2026-01-08T10:15:46.833", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L169"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/gutenverse-form/tags/2.3.2/lib/framework/includes/class-init.php#L837"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3427504/gutenverse-form/trunk/lib/framework/includes/class-init.php?old=3395520&old_path=gutenverse-form%2Ftrunk%2Flib%2Fframework%2Fincludes%2Fclass-init.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/792fa6cb-e55a-4f68-b8a8-9039fb1ff694?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:02:56.929976+00:00", "value": {"mitigation_remediation": ["Upgrade the Gutenverse Form plugin to a version that removes SVG upload support or sanitizes SVG content.", "If an upgrade cannot be performed immediately, block the SVG MIME type by modifying the upload_mimes filter or using a security plugin to prevent SVG uploads for all users.", "Locate and delete any SVG files already present in the media library that were uploaded by users with Author or higher roles to eliminate stored payloads."], "summary": {"action": "Patch", "impact": "Client\u2011Side JavaScript Execution"}, "threat_synthesis": {"affected_systems": "All releases of the Jegstudio Gutenverse Form \u2013 Contact Form Builder, Booking, Reservation, Subscribe for Block Editor plugin for WordPress up to and including version 2.3.2 are affected.", "description_and_impact": "The Gutenverse Form plugin contains a stored cross\u2011site scripting flaw that allows an authenticated user with Author-level access or higher to upload an SVG file containing malicious JavaScript. When the file is viewed, the script runs in the victim\u2019s browser, enabling the attacker to steal credentials, deface the site, or perform other client\u2011side attacks. The vulnerability stems from the plugin adding SVG to the allowed MIME types without sanitizing the file contents.", "risk_and_exploitability": "The flaw has a CVSS score of 6.4 indicating moderate severity. The EPSS score is below 1\u202f%, suggesting a low but non\u2011zero likelihood of exploitation. It is not listed in CISA\u2019s KEV catalog. Attackers must first authenticate to the site with Author or higher privileges, upload a malicious SVG, and then wait for other site visitors to view the file to trigger the JavaScript."}}}}, "created": "2026-01-12T14:38:25.358906+00:00", "updated": "2026-04-22T00:15:03.762867+00:00", "vendors": ["jegstudio", "jegstudio$PRODUCT$gutenverse", "wordpress", "wordpress$PRODUCT$wordpress"]}