CVE-2026-19697
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.
- Affected products
- Gutenkit
- Fix
- Available
- CVSS 3.1
- 6.8 MEDIUM
- EPSS
- 0.3% (21th percentile)
- Weakness
- CWE-79
- NVD status
- Deferred
- Published
- 2026-08-20
CVE-2026-19697 at NVD
No indexed exploits for CVE-2026-19697 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-19697 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.