Gutenkit
Monthly
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role - or any role with file upload capability - to upload maliciously crafted SVG files through plugin-enabled upload paths that lack sanitization, executing arbitrary JavaScript in the browsers of any user who subsequently opens the file, including site administrators. A publicly available proof-of-concept exists via WPScan, and the SSVC framework rates technical impact as 'total,' meaning successful targeting of an administrator session could yield full WordPress site compromise. The vendor has released a remediated version (2.5.0), and exploitation status is rated 'none' by SSVC at time of analysis despite the public exploit code.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit allows Stored XSS.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CSS injection in GutenKit WordPress plugin (versions before 2.5.1) allows any authenticated user holding the Contributor role or above to embed arbitrary stylesheets into posts served to all site visitors and anonymous users. The plugin fails to validate or escape style settings before interpolating them into CSS output on the front end, enabling defacement, interface redressing, and forced loading of external resources. JavaScript execution is explicitly ruled out at the Contributor privilege tier, capping the attack surface below full cross-site scripting. A publicly available exploit has been disclosed by WPScan.
Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role - or any role with file upload capability - to upload maliciously crafted SVG files through plugin-enabled upload paths that lack sanitization, executing arbitrary JavaScript in the browsers of any user who subsequently opens the file, including site administrators. A publicly available proof-of-concept exists via WPScan, and the SSVC framework rates technical impact as 'total,' meaning successful targeting of an administrator session could yield full WordPress site compromise. The vendor has released a remediated version (2.5.0), and exploitation status is rated 'none' by SSVC at time of analysis despite the public exploit code.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit allows Stored XSS.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.