Gutenkit Blocks Addon Vulnerabilities

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for auth...

CVSS:

6.4

(Wordfence)

Affected:

up to 2.4.4

Fixed in:

2.4.5

Disclosed:

Sep 2, 2026

CVE-2026-2573 on NVD →

The GutenKit plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 2.5.0. This is due to missing capability check on the saving user before persisting CSS style settings to post meta and block attributes, and missing trust validation before rendering those settings as an inline style...

CVSS:

4.3

(Wordfence)

Affected:

up to 2.5.0

Fixed in:

2.5.1

Disclosed:

Sep 1, 2026

CVE-2026-19698 on NVD →

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 2.5.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVSS:

6.4

(Wordfence)

Affected:

up to 2.5.0

Fixed in:

2.5.0

Disclosed:

Aug 21, 2026

CVE-2026-19697 on NVD →

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.15. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive user...

CVSS:

4.3

(Wordfence)

Affected:

up to 2.4.15

Fixed in:

2.5.0

Disclosed:

Aug 21, 2026

CVE-2026-19699 on NVD →

The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are registered with permiss...

CVSS:

5.3

(Wordfence)

Affected:

up to 2.4.12

Fixed in:

2.4.13

Disclosed:

Jul 22, 2026

CVE-2026-15827 on NVD →

The GutenKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi...

CVSS:

6.4

(Wordfence)

Affected:

up to 2.4.2

Fixed in:

2.4.3

Disclosed:

Sep 22, 2025

CVE-2025-57900 on NVD →

The GutenKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi...

CVSS:

6.4

(Wordfence)

Affected:

up to 2.2.2

Fixed in:

2.2.3

Disclosed:

Apr 22, 2025

CVE-2025-46253 on NVD →

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and includin...

CVSS:

9.8

(Wordfence)

Affected:

up to 2.1.0

Fixed in:

2.1.1

Disclosed:

Oct 10, 2024

CVE-2024-9234 on NVD →