CVE-2026-19697

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...

CVE-2026-19697

The GutenKit WordPress plugin (before 2.5.0) fails to sanitise SVG files on all enabled upload paths, allowing users with the file-upload capability (e.g. Author role) to upload a malicious SVG and execute Stored XSS against any viewer, including administrators. CVSS 3.1 scores 6.8 (MEDIUM). Upgr...