CVE-2026-19698 — LOW (3.5) — White Hats Nepal

Vulnerability Description

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.

CVSS Score

3.5

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-74

References

https://wpscan.com/vulnerability/0e6cd37e-3004-498d-8d8d-21617138888a/

FAQ

What is CVE-2026-19698?

CVE-2026-19698 is a vulnerability with a CVSS score of 3.5 (LOW). The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contr...

How severe is CVE-2026-19698?

CVE-2026-19698 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-19698?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.