EUVD-2026-70036
GHSA-q4xj-fj7m-v23h
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
WordPress Contributors are low-privilege authenticated users (PR:L not PR:H); all other metrics align with the documented CSS-only injection impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.
AnalysisAI
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with at least the Contributor role - unauthenticated visitors cannot trigger the injection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS base score of 3.5 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N accurately reflects the constrained impact, but the PR:H metric is inconsistent with the description - the WordPress Contributor role is a low-privilege authenticated role (PR:L), and correcting this metric would push the base score modestly higher. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update GutenKit to version 2.5.1 or later, which resolves the missing validation and escaping of style settings before CSS output. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or abo
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today