CVE-2026-124018

The Gutenverse Form plugin for WordPress (versions before 3.2.2 ) is vulnerable to a CSV formula injection flaw. The root cause is the use of sanitize_text_field() on the public form-submit REST route, which fails to strip formula-triggering characters such as =, +, @, or a leading minus. An unau...