---
id: "CVE-2026-114427"
page: "https://infrastack.ai/live/CVE-2026-114427"
kind: "vulnerability"
aliases: ["CVE-2026-114427"]
title: "GutenKit WordPress plugin: stored script runs for visitors via post CSS"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gutenkit", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-author-role-users", "plugin-at-2.5.5-or-later"]
published_at: "2026-11-06T06:16:40+00:00"
first_seen_at: "2026-11-06T06:40:11+00:00"
updated_at: "2026-11-06T06:41:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114427", "first_seen_at": "2026-11-06T06:40:11+00:00"}]
exploit_sources: []
---

# GutenKit WordPress plugin: stored script runs for visitors via post CSS

Link for people: https://infrastack.ai/live/CVE-2026-114427 (this .md is for agents)

The GutenKit WordPress plugin before 2.5.5 does not sanitize custom CSS saved on a post before printing it in an inline style block. A user with the Author role or higher can break out of the style element and store JavaScript that runs in the browser of every visitor who views the post.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GutenKit plugin version in the WordPress admin under Plugins, or with `wp plugin get gutenkit --field=version` if WP-CLI is available.
- Look for posts whose custom CSS contains `</style>` or `<script` tags.

## Fix

- GutenKit plugin: `2.5.5`
- The description also states exploitation affects sites running WordPress below `7.0`.

## Timeline

- 2026-11-06T06:40:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114427

## From the sources

The GutenKit  WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_