Stored Cross-Site Scripting Vulnerability in GutenKit WordPress Plugin
CVE-2026-19697
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19697?
The GutenKit WordPress plugin prior to version 2.5.0 is vulnerable due to inadequate sanitization of uploaded SVG files, particularly on various upload paths. This flaw allows users with file upload permissions, such as Authors, to upload malicious SVG files. Consequently, these files can initiate Stored Cross-Site Scripting attacks, potentially impacting any user who accesses them, including site administrators. This vulnerability underscores the importance of secure file handling practices within WordPress plugins.
Affected Version(s)
GutenKit 0 < 2.5.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.