CVE-2026-19698
GutenKit < 2.5.1 - Contributor+ Stored CSS Injection
CVSS Score
3.5
EPSS Score
0.0%
EPSS Percentile
0th
The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.
| Vendor | unknown |
| Product | gutenkit |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown gutenkit
Be the first to know when new low vulnerabilities affecting unknown gutenkit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / GutenKit
0 < 2.5.1
References
Credits
Haitam Lazaar WPScan