CVE-2026-19697

Deferred Deferred - Pending Action

Stored XSS in GutenKit WordPress Plugin

Publication date: 2026-08-20

Last updated on: 2026-08-26

Assigner: WPScan

Description

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-26

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-19697

EUVD

EUVD-2026-63204

Affected Vendors & Products

Vendor	Product	Version / Range
gutenkit	gutenkit	to 2.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The GutenKit WordPress plugin before version 2.5.0 allows users with file upload permissions, such as Authors, to upload malicious SVG files without proper sanitization. This enables Stored Cross-Site Scripting attacks where the malicious SVG executes arbitrary scripts when viewed by other users, including administrators.

Detection Guidance

Check for unauthorized SVG uploads in WordPress directories, especially in uploads folders. Look for files with .svg extension that may contain suspicious scripts. Review user roles with upload capabilities like Authors.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into SVG files that execute when viewed by other users. This can lead to unauthorized actions, data theft, or account compromise for users with administrative privileges.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Update the GutenKit plugin to version 2.5.0 or later immediately. Remove any suspicious SVG files from the system. Restrict file upload capabilities to trusted users only.

Hi! I’m here to help you understand CVE-2026-19697. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70