Executive brief
GutenKit is a popular WordPress page builder plugin that extends the Gutenberg block editor with additional blocks, patterns, and templates. A stored cross-site scripting vulnerability allows authenticated users with Contributor access or higher to inject malicious scripts into pages. When other users visit the affected pages, the injected scripts execute in their browsers, potentially enabling account compromise, data theft, or malware distribution.
Technical details
The plugin fails to properly sanitize and escape user input in the 'postBodyCss' parameter, allowing authenticated attackers with Contributor-level privileges or above to inject arbitrary JavaScript that persists in the database as stored XSS. The vulnerability affects all versions up to and including 2.4.4. Since the vulnerability requires authentication at Contributor level or above, the attack surface is limited to users with editing capabilities on the WordPress site. Once injected, the malicious script executes in the context of any user viewing the affected page, bypassing execution restrictions and enabling potential privilege escalation or data exfiltration.
Affected products
- Guten GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor up to and including 2.4.4
Timeline
- 2026-09-03: disclosed