CVE-2026-19697
GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload
- State
- Published
- Severity
- 6.8 Medium
- Published
- Aug 20, 2026
- Updated
- Aug 20, 2026
- Reserved
- Aug 13, 2026
Description
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
GutenKitUnknown |
|
References
- https://wpscan.com/vulnerability/d144679c-10ef-4a69-b0e9-fd9e18a2aafc/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.