2.7
Low
CVE-2026-19699 The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API…
Description
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GutenKit 2.4 | 2.4.12 → < 2.5.0 | 2.5.0 |
Other CVEs of GutenKit
The 4 CVEs of GutenKit →
CVE-2026-114427
GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS
6.8
Medium
CVE-2026-19698
The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before…
3.5
Low
CVE-2026-19697
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it…
6.8
Medium