UNKNOWN NVD

CVE-2026-19697

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capa

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.

References

https://wpscan.com/vulnerability/d144679c-10ef-4a69-b0e9-fd9e18a2aafc/

Published: 2026-08-20 · Source: NVD · Feed updated: 2026-08-20

This unknown severity vulnerability was published on 2026-08-20 via NVD.

vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.