GutenKit < 2.5.0 – Author+ Stored XSS via SVG Upload | CVE 2026-19697

Description

The plugin does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.

Proof of Concept

The PoC will be displayed on September 01, 2026, to give users the time to update.

Affects Plugins

gutenkit-blocks-addon

Fixed in 2.5.0

References

CVE

CVE-2026-19697

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

6.8 (medium)

Miscellaneous

Original Researcher

Yaswanth Reddy Sunkara

Submitter

Yaswanth Reddy Sunkara

Verified

Yes

WPVDB ID

d144679c-10ef-4a69-b0e9-fd9e18a2aafc

Timeline

Publicly Published

2026-08-18 (about 3 days ago)

Added

2026-08-18 (about 2 days ago)

Last Updated

2026-08-18 (about 2 days ago)

Other

Published

Title

Published

2021-10-20

Title

Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting

Published

2024-06-05

Title

MapFig Studio <= 0.2.1 - Stored XSS via CSRF

Published

2024-02-03

Title

Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS

Published

2014-08-01

Title

WP Super Cache 1.3 - trunk/plugins/awaitingmoderation.php URI XSS

Published

2025-01-03

Title

Digi Store <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting