Cross-Site Scripting in GutenKit WordPress Plugin Affects User-Generated Content
CVE-2026-114427
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-114427?
The GutenKit WordPress plugin prior to version 2.5.5 is susceptible to a security flaw that fails to sanitize custom CSS input. This oversight enables users with roles of Author and above to inject malicious JavaScript. When the script is stored within an inline style block on a published page, it executes in the browsers of visitors, posing a serious security risk for sites operating on WordPress versions prior to 7.0.
Affected Version(s)
GutenKit 2.5.0 < 2.5.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.