CVE-2026-81432
JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.
| Vendor | unknown |
| Product | jetstylemanager for gutenberg |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown jetstylemanager for gutenberg
Be the first to know when new medium vulnerabilities affecting unknown jetstylemanager for gutenberg are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / JetStyleManager for Gutenberg
0 < 1.3.9
References
Credits
Huynh Kien Minh WPScan