GutenKit CVE-2026-19697

Exploitation requires a valid WordPress account with the upload_files capability - at minimum the Author role. Sites that grant Author access only to fully trusted internal staff have substantially lower exposure than those with open contributor registration. The attacker must craft and upload a malicious SVG through one of GutenKit's non-sanitizing upload paths (the description notes 'all of the upload paths it enables' lack consistent sanitization, implying multiple paths exist). A second user - specifically one with meaningful browser context, such as an administrator - must actively open or render the uploaded SVG file for the XSS payload to execute. Exploitation is therefore not automatable (SSVC: Automatable: no) and is constrained by the required victim interaction. Exploitation is further limited to WordPress installations running GutenKit versions prior to 2.5.0.

The provided CVSS vector (PR:H/UI:R/S:U, score 6.8) merits scrutiny: the description explicitly states exploitation is possible by Author-level users, but the WordPress Author role is a low-privileged account tier - PR:L is a more accurate representation than PR:H, which understates attacker accessibility. UI:R is correctly set since a victim must open the SVG. The S:U (Unchanged scope) choice is also debatable, as the XSS payload executes in a different user's browser context, which aligns more naturally with S:C. These metric inconsistencies likely undercount real-world exploitability. SSVC independently rates technical impact as 'total' but exploitation as 'none,' indicating no confirmed active exploitation despite a public POC, which is consistent with the absence of a CISA KEV listing. EPSS data is not provided. Realistic risk is elevated on WordPress installations with untrusted or community-contributed Author accounts; sites where only internal trusted staff hold Author roles face a more manageable threat surface. The public POC reported by WPScan lowers the attack barrier, but the required user interaction (admin must open the file) limits automatable mass exploitation.

An attacker with a legitimate Author account on a target WordPress site uploads a crafted SVG file containing an embedded JavaScript payload (e.g., a cookie-stealing script) through one of GutenKit's unsanitized upload paths. When a site administrator browses to the media library or a page that renders the uploaded SVG, their browser executes the payload, exfiltrating the admin's session cookie to an attacker-controlled endpoint. A public proof-of-concept for this attack pattern is available via WPScan, reducing the technical skill required for exploitation.