What is GHSA-q4xj-fj7m-v23h?

GHSA-q4xj-fj7m-v23h is a security advisory published by GitHub Security Advisories with Low severity. The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved...

Which CVE IDs does GHSA-q4xj-fj7m-v23h cover?

GHSA-q4xj-fj7m-v23h covers the following CVE IDs: CVE-2026-19698. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q4xj-fj7m-v23h?

GHSA-q4xj-fj7m-v23h has a CVSS v3 base score of 3.5, published by GitHub Security Advisories.

GHSA-q4xj-fj7m-v23hLowCVSS 3.5

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved...

Vendor

GitHub Security Advisories

Published

September 2, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-19698 →

📋 Description

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-19698
https://wpscan.com/vulnerability/0e6cd37e-3004-498d-8d8d-21617138888a
https://github.com/advisories/GHSA-q4xj-fj7m-v23h