CVE-2025-66079

MediumCVSS 6.5

Published: 21/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

The Gutenverse Form plugin for WordPress (versions up to and including 2.2.0) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

Risk Assessment

Attackers may perform unauthorized actions, potentially modifying or accessing form data.

Recommendation

Update the Gutenverse Form plugin to the latest version (above 2.2.0) to remediate the vulnerability.

Other vulnerabilities in Gutenverse Form WordPress plugin

CVE-2026-106469Medium
The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser. This allows authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in the session of any user who views or previews the affected form, such as an administrator reviewing a pending post.

Original NVD description (English source)

Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse Form: from n/a through <= 2.2.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS