{"id":"CVE-2026-114427","kind":"vulnerability","aliases":["CVE-2026-114427"],"related":[],"title":"GutenKit WordPress plugin: stored script runs for visitors via post CSS","description":"The GutenKit  WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.","summary":"The GutenKit WordPress plugin before 2.5.5 does not sanitize custom CSS saved on a post before printing it in an inline style block. A user with the Author role or higher can break out of the style element and store JavaScript that runs in the browser of every visitor who views the post.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gutenkit","package","self-hosted","wordpress"],"not_affected_if":["no-author-role-users","plugin-at-2.5.5-or-later"],"how_to_check":"- Check the installed GutenKit plugin version in the WordPress admin under Plugins, or with `wp plugin get gutenkit --field=version` if WP-CLI is available.\n- Look for posts whose custom CSS contains `</style>` or `<script` tags.","fix":"- GutenKit plugin: `2.5.5`\n- The description also states exploitation affects sites running WordPress below `7.0`.","status":"open","published_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:41:58+00:00","updated_at":"2026-11-06T06:41:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:41:58Z","model":"claude-haiku-5-5","output":{"fix":"- GutenKit plugin: `2.5.5`\n- The description also states exploitation affects sites running WordPress below `7.0`.","reach":"internet","title":"GutenKit WordPress plugin: stored script runs for visitors via post CSS","impact":"medium","summary":"The GutenKit WordPress plugin before 2.5.5 does not sanitize custom CSS saved on a post before printing it in an inline style block. A user with the Author role or higher can break out of the style element and store JavaScript that runs in the browser of every visitor who views the post.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gutenkit","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker-stored JavaScript runs in every visitor's browser on the site","analyst_note":"","how_to_check":"- Check the installed GutenKit plugin version in the WordPress admin under Plugins, or with `wp plugin get gutenkit --field=version` if WP-CLI is available.\n- Look for posts whose custom CSS contains `</style>` or `<script` tags.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-at-2.5.5-or-later","no-author-role-users"],"who_is_affected":"Sites running the GutenKit WordPress plugin older than 2.5.5 where Author-level or higher users can edit post custom CSS. The description says exploitation affects sites running WordPress below 7.0. Sites that do not use the plugin, or where only trusted editors can write content, face much less risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4239,"output_tokens":592,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114427':14A,17A '-2026':13A,16A '2.5.5':29B,82C '7.0':141C 'affect':136C 'allow':105C 'author':51B,109C 'block':46B,100C 'break':56B,114C 'browser':69B,127C 'css':11A,34B,88C 'custom':33B,87C 'cve':12A,15A 'element':61B,119C 'everi':71B 'execut':124C 'exploit':135C 'gutenkit':1A,18B,25B,78C 'higher':54B 'host':22B 'inlin':44B,98C 'insid':96C 'javascript':64B,122C 'packag':19B 'page':104C 'plugin':3A,27B,80C 'post':10A,38B,76B,92C,134C 'print':40B,94C 'proper':85C 'publish':103C 'role':52B,110C 'run':6A,66B,138C 'sanit':32B,86C 'save':35B,89C 'script':5A 'self':21B 'self-host':20B 'site':137C 'store':4A,63B,121C 'style':45B,60B,99C,118C 'user':48B,106C 'via':9A 'view':74B,132C 'visitor':8A,72B,130C 'wordpress':2A,23B,26B,79C,139C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GutenKit WordPress plugin older than 2.5.5 where Author-level or higher users can edit post custom CSS. The description says exploitation affects sites running WordPress below 7.0. Sites that do not use the plugin, or where only trusted editors can write content, face much less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gutenkit","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-114427':14A,17A '-2026':13A,16A 'css':11A 'cve':12A,15A 'gutenkit':1A 'plugin':3A 'post':10A 'run':6A 'script':5A 'store':4A 'via':9A 'visitor':8A 'wordpress':2A","search_b":"'2.5.5':29B 'author':51B 'block':46B 'break':56B 'browser':69B 'css':34B 'custom':33B 'element':61B 'everi':71B 'gutenkit':18B,25B 'higher':54B 'host':22B 'inlin':44B 'javascript':64B 'packag':19B 'plugin':27B 'post':38B,76B 'print':40B 'role':52B 'run':66B 'sanit':32B 'save':35B 'self':21B 'self-host':20B 'store':63B 'style':45B,60B 'user':48B 'view':74B 'visitor':72B 'wordpress':23B,26B","search_c":"'2.5.5':82C '7.0':141C 'affect':136C 'allow':105C 'author':109C 'block':100C 'break':114C 'browser':127C 'css':88C 'custom':87C 'element':119C 'execut':124C 'exploit':135C 'gutenkit':78C 'inlin':98C 'insid':96C 'javascript':122C 'page':104C 'plugin':80C 'post':92C,134C 'print':94C 'proper':85C 'publish':103C 'role':110C 'run':138C 'sanit':86C 'save':89C 'site':137C 'store':121C 'style':99C,118C 'user':106C 'view':132C 'visitor':130C 'wordpress':79C,139C","first_public_at":"2026-11-06T06:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114427","severity":null,"published_at":"2026-11-06T06:16:40+00:00","modified_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}