Unrated severityNVD Advisory· Published Aug 20, 2026

CVE-2026-19697

Description

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.

Affected products

WordPress/GutenKitllm-fuzzy
Range: <2.5.0

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/d144679c-10ef-4a69-b0e9-fd9e18a2aafc/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000