EUVD-2026-63204
GHSA-wx8r-3g94-mv2j
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Author role is PR:L not PR:H; XSS executes in a distinct user's browser context warranting S:C; availability impact is not applicable for session hijack via stored XSS.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.
AnalysisAI
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role - or any role with file upload capability - to upload maliciously crafted SVG files through plugin-enabled upload paths that lack sanitization, executing arbitrary JavaScript in the browsers of any user who subsequently opens the file, including site administrators. A publicly available proof-of-concept exists via WPScan, and the SSVC framework rates technical impact as 'total,' meaning successful targeting of an administrator session could yield full WordPress site compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with the upload_files capability - at minimum the Author role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (PR:H/UI:R/S:U, score 6.8) merits scrutiny: the description explicitly states exploitation is possible by Author-level users, but the WordPress Author role is a low-privileged account tier - PR:L is a more accurate representation than PR:H, which understates attacker accessibility. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a legitimate Author account on a target WordPress site uploads a crafted SVG file containing an embedded JavaScript payload (e.g., a cookie-stealing script) through one of GutenKit's unsanitized upload paths. When a site administrator browses to the media library or a page that renders the uploaded SVG, their browser executes the payload, exfiltrating the admin's session cookie to an attacker-controlled endpoint. … |
| Remediation | Update GutenKit to version 2.5.0 or later, which introduces SVG sanitization across all plugin-enabled upload paths. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today