Gutenkit Blocks Addon Vulnerabilities

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 2.5.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVSS:

6.4

Affected:

up to 2.5.0

Fixed in:

2.5.0

Disclosed:

Aug 21, 2026

CVE-2026-19697 on NVD →

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.15. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive user...

CVSS:

4.3

Affected:

up to 2.4.15

Fixed in:

2.5.0

Disclosed:

Aug 21, 2026

CVE-2026-19699 on NVD →

The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are registered with permiss...

CVSS:

5.3

Affected:

up to 2.4.12

Fixed in:

2.4.13

Disclosed:

Jul 22, 2026

CVE-2026-15827 on NVD →

The GutenKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi...

CVSS:

6.4

Affected:

up to 2.4.2

Fixed in:

2.4.3

Disclosed:

Sep 22, 2025

CVE-2025-57900 on NVD →

The GutenKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi...

CVSS:

6.4

Affected:

up to 2.2.2

Fixed in:

2.2.3

Disclosed:

Apr 22, 2025

CVE-2025-46253 on NVD →

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and includin...

CVSS:

9.8

Affected:

up to 2.1.0

Fixed in:

2.1.1

Disclosed:

Oct 10, 2024

CVE-2024-9234 on NVD →