6.8
Moyenne
CVE-2026-19697 The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it…
Description
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| GutenKit 2.5 | premières → < 2.5.0 | 2.5.0 |
Autres CVE de GutenKit
Les 4 CVE de GutenKit →
CVE-2026-114427
GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS
6.8
Moyenne
CVE-2026-19698
The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before…
3.5
Faible
CVE-2026-19699
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API…
2.7
Faible