WordPress JetStyleManager for Gutenberg plugin < 1.3.9 - Skin Deletion and Modification vulnerability

Skin Deletion and Modification vulnerability discovered by Huynh Kien Minh in WordPress Plugin JetStyleManager for Gutenberg versions 1.3.9...

EUVD-2026-69856

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the editposts capability Contributor and above delete or modify custom widget skins via a crafted request, provided they can...