Answer in brief
CVE-2026-124018 records a Medium severity (CVSS 5.3) vulnerability in Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission. The current sources do not mark it as known exploited. The current feed maps Jegstudio/Gutenverse Form – Contact Form Builder, Block Form & Booking Form (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Jegstudio/Gutenverse Form – Contact Form Builder, Block Form & Booking Form (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Jegstudio/Gutenverse Form – Contact Form Builder, Block Form & Booking Formgeneric | >=0 <3.2.2 | 3.2.2 |
Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via fputcsv() or esc_html() in the CSV export functions, causing the formula to execute when an administrator opens the exported file, enabling data exfiltration to an attacker-controlled URL or command execution on the administrator's workstation.
Quoted source text, attributed separately from HOL analysis.