CVE-2025-14984 is a stored cross-site scripting vulnerability in the Gutenverse Form plugin for WordPress, affecting all versions up to 2.3.2. The issue arises from the plugin's framework component adding SVG files to allowed MIME types via the upload_mimes filter without sanitizing the SVG content. This allows authenticated users with Author-level privileges or higher to upload SVG files containing malicious JavaScript. When these SVG files are viewed, the embedded script executes in the context of the victim's browser, leading to arbitrary JavaScript execution. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity). No known exploits in the wild have been reported, and no patch or official fix information is currently available.

Successful exploitation allows authenticated users with Author-level access or above to execute arbitrary JavaScript in the browsers of users who view the malicious SVG files. This can lead to session hijacking, defacement, or other client-side attacks. The impact is limited by the requirement for authenticated access at a relatively high privilege level and the absence of reported active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level and higher user permissions to trusted individuals only. Consider disabling SVG uploads or implementing server-side SVG sanitization as a temporary mitigation. Monitor vendor channels for updates or patches addressing this vulnerability.