CVE-2026-19697CWE-79cross-site-scripting
CVE-2026-19697
Medium · published August 20, 2026
What it is
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.
The record
Technical detail
- CVSS v3.1
- 6.8 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00431 · 36.3th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-08-20T10:17Z
References (1)
EPSS history
Timeline