The Gutenverse News WordPress plugin prior to version 3.3.3 does not properly restrict the extra HTML elements it adds to WordPress's allowed elements list to the intended context. Instead, it applies the same relaxed sanitization rules globally, including to untrusted comment inputs. This flaw enables unauthenticated attackers to store malicious JavaScript in comments, which executes in the browser of any administrator who reviews the comment queue and any visitor who views the post after comment approval.

An unauthenticated attacker can inject persistent JavaScript code via comments. This code executes in the context of administrators reviewing comments and site visitors viewing the affected posts, potentially leading to session hijacking, privilege escalation, or other malicious actions within the affected site.

Upgrade the Gutenverse News plugin to version 3.3.3 or later, where this issue is fixed. No other mitigation guidance is provided. Patch status is not explicitly stated in the input data, but the affectedVersions field indicates the vulnerability is fixed starting at 3.3.3.