CVE-2026-19698

LowCVSS 3.5/10Last modified Sep 3, 2026

Description

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-196992.7The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users wi CVE-2026-19706.1A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. Th CVE-2026-197027.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technolo CVE-2026-197045.3The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inj CVE-2026-197085.9The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in CVE-2026-197095.3The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before c CVE-2026-19714.8A vulnerability has been found in Edimax BR-6288ACL up to 1.12. Impacted is the function wiz_WISP24gmanual of the file wiz_WISP24gmanual.asp CVE-2026-197107.3A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of CVE-2026-197116.5The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balan CVE-2026-197126.1The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants i CVE-2026-197135.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu CVE-2026-197149.1The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauth