A critical Stored Cross-Site Scripting vulnerability in the Gutenverse News WordPress plugin allows unauthenticated attackers to execute malicious JavaScript in the browsers of administrators and site visitors.

The plugin incorrectly handles sanitization contexts for HTML elements, permitting unauthenticated users to inject and store malicious scripts within the comment section. This script executes when an administrator views the comment queue or when a visitor accesses the affected post.

The exploitation of this vulnerability poses a significant threat to site integrity and administrative access. Successful execution of JavaScript in an administrator session can lead to unauthorized actions, account takeover, or site defacement, justifying the high CVSS score of 8.8. Furthermore, the risk to end-users visiting the site may lead to a loss of customer trust and potential reputational damage.

Immediate Action: Update the Gutenverse News plugin to version 3.3.3 or later immediately to resolve the improper sanitization flaw.

Proactive Monitoring: Review application logs for unusual comment submissions or high volumes of script-like content within user-submitted form data.

Compensating Controls: Deploy a Web Application Firewall with rules enabled to detect and block common cross-site scripting patterns in HTTP POST requests.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the ease of exploitation by unauthenticated actors, necessitates immediate action. Administrators must prioritize updating the Gutenverse News plugin to the patched version, 3.3.3, to prevent potential script injection. Delaying this update exposes both the administrative backend and site visitors to significant risk.