Gutenkit
Monthly
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role - or any role with file upload capability - to upload maliciously crafted SVG files through plugin-enabled upload paths that lack sanitization, executing arbitrary JavaScript in the browsers of any user who subsequently opens the file, including site administrators. A publicly available proof-of-concept exists via WPScan, and the SSVC framework rates technical impact as 'total,' meaning successful targeting of an administrator session could yield full WordPress site compromise. The vendor has released a remediated version (2.5.0), and exploitation status is rated 'none' by SSVC at time of analysis despite the public exploit code.
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role - or any role with file upload capability - to upload maliciously crafted SVG files through plugin-enabled upload paths that lack sanitization, executing arbitrary JavaScript in the browsers of any user who subsequently opens the file, including site administrators. A publicly available proof-of-concept exists via WPScan, and the SSVC framework rates technical impact as 'total,' meaning successful targeting of an administrator session could yield full WordPress site compromise. The vendor has released a remediated version (2.5.0), and exploitation status is rated 'none' by SSVC at time of analysis despite the public exploit code.