CVE-2026-114427 · Package
NO FIX YET · SEE WHAT TO DO
The GutenKit WordPress plugin before 2.5.5 does not sanitize custom CSS saved on a post before printing it in an inline style block. A user with the Author role or higher can break out of the style element and store JavaScript that runs in the browser of every visitor who views the post.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the GutenKit WordPress plugin older than 2.5.5 where Author-level or higher users can edit post custom CSS. The description says exploitation affects sites running WordPress below 7.0. Sites that do not use the plugin, or where only trusted editors can write content, face much less risk.
Not affected if no-author-role-users, plugin-at-2.5.5-or-later
Who cares gutenkit, self-hosted, wordpress
wp plugin get gutenkit --field=version if WP-CLI is available.</style> or <script tags.2.5.57.0.The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.