CVE-2026-19697: GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress GutenKit pluginto a version that resolves this vulnerability.Fixed in 2.5.0 - Configuration
Ensure GutenKit sanitizes uploaded SVG files on all enabled upload paths (the vulnerability exists in GutenKit versions before 2.5.0 where sanitization is not applied to all upload paths).
WordPress GutenKit plugin SVG upload sanitization = enabled - Compensating control
Restrict the WordPress file upload capability (e.g., limit Author role or other users that can upload files) to reduce exposure to stored XSS via malicious SVG uploads.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any user with WordPress file-upload capability can exploit it. This includes Author-level users where that capability is available.
Who is affected by a malicious upload?
Any user who opens the malicious SVG can be affected, including WordPress administrators.
What is required to trigger the cross-site scripting?
An attacker must be able to upload a malicious SVG through an upload path enabled by GutenKit, and a victim must open that uploaded file.
Are all SVG upload paths protected?
No. Versions before 2.5.0 do not sanitize uploaded SVG files on all upload paths that the plugin enables.