6.8
Medium
CVE-2026-19697 The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it…
Description
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GutenKit 2.5 | earliest → < 2.5.0 | 2.5.0 |
Other CVEs of GutenKit
The 4 CVEs of GutenKit →
CVE-2026-114427
GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS
6.8
Medium
CVE-2026-19698
The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before…
3.5
Low
CVE-2026-19699
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API…
2.7
Low