CVE-2026-114427: GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS

Published Nov 6, 2026

Updated

The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

A user with the WordPress Author role or a higher-privileged role can store the malicious payload through page settings custom CSS. JavaScript executes in the browser of any visitor who views the affected published post.

Are all WordPress sites using the affected plugin versions vulnerable?

No. Exploitation affects sites running WordPress below 7.0 and GutenKit versions 2.5.0 through 2.5.4; the issue is fixed in GutenKit 2.5.5.

What must an attacker do to exploit the vulnerability?

The attacker must have an Author-or-higher WordPress account and be able to save custom CSS against a post. They can then escape the inline style block and store JavaScript for execution when the post is viewed.

How can administrators identify potentially affected content?

Review posts created or editable by Author-level and higher users for page-settings custom CSS, especially CSS containing markup intended to terminate a style element. Affected sites are those using GutenKit 2.5.0 through 2.5.4 on WordPress versions below 7.0.

CVE-2026-114427: GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS

Event History

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

Are all WordPress sites using the affected plugin versions vulnerable?

What must an attacker do to exploit the vulnerability?

How can administrators identify potentially affected content?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

Are all WordPress sites using the affected plugin versions vulnerable?

What must an attacker do to exploit the vulnerability?

How can administrators identify potentially affected content?