blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-124018

MEDIUM 5.3 CVSS 4.0
Published
November 12, 2026
Last modified
November 12, 2026
NVD status
Received
Reported by
disclosure@vulncheck.com
Weakness
CWE-1236
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.

Affected WordPress components

  • Gutenverse Form – Contact Form Builder, Block Form & Booking Form Plugin · gutenverse-form
    Confirmed match Active
    Before 3.2.2
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Jegstudio Gutenverse Form – Contact Form Builder, Block Form & Booking Form — Before 3.2.2

References

  • wordpress.org https://wordpress.org/plugins/gutenverse-form/#developers
  • www.vulncheck.com https://www.vulncheck.com/advisories/gutenverse-form-wordpress-plugin-csv-formula-injection-via-form-submission
  • nvd.nist.gov Official NVD record