CVE-2026-114427

Full vulnerability record from the local CVENow database.

Description

The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-06 06:16:40.160000

Last modified

2026-11-06 06:16:40.160000

View original CVE JSON

{
  "id": "CVE-2026-114427",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T06:16:40.160",
  "lastModified": "2026-11-06T06:16:40.160",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The GutenKit  WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "GutenKit",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2.5.0",
              "lessThan": "2.5.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/c5380cc6-55e5-4ccd-8b83-c611139800b1/",
      "source": "[email protected]"
    }
  ]
}