Description

The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-11-06T06:16:40.160Z",
  "pubdate": "2026-11-06T06:16:40.160Z",
  "executiveSummary": "The GutenKit WordPress plugin prior to version 2.5.5 contains a stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization of custom CSS inputs.\nThis vulnerability allows authenticated users with Author-level privileges or higher to inject and persist malicious JavaScript payloads within post metadata.\nWhen a victim, including administrative users, views a post containing the malicious CSS block, the injected JavaScript executes within the context of the visitor's browser session.\nThe impact is significant, potentially leading to unauthorized actions, account takeover, session hijacking, or the distribution of further malicious content.\nExploitation requires authenticated access with at least Author-level permissions, limiting the attack surface to trusted internal users or compromised accounts.\nThe vulnerability is contingent upon the WordPress version, specifically affecting sites running versions below 7.0.",
  "technicalDetails": "The vulnerability originates from a failure to perform adequate input validation and output encoding on custom CSS properties processed by the GutenKit plugin. The plugin permits users to define custom CSS rules that are subsequently rendered directly into the HTML of a published page via an inline <style> block.\nThe root cause is the improper handling of user-supplied data, which fails to neutralize control characters that facilitate breaking out of the style context. Specifically, the input sanitization mechanism fails to properly escape or filter sequences like '</style><script>'.\nAn authenticated user with Author privileges or higher can manipulate the custom CSS field by injecting an arbitrary closing style tag followed by a script element. For example, by providing a payload formatted as 'x</style><script>alert(document.cookie)</script>', the attacker forces the browser to terminate the style element prematurely and parse the subsequent content as executable JavaScript.\nThe attack flow follows these steps: First, the attacker navigates to the Gutenberg editor interface for a post where GutenKit features are active. Second, the attacker inserts the malicious payload into the designated custom CSS fields provided by the plugin. Third, the plugin saves the unsanitized string into the WordPress database as post metadata. Fourth, when a visitor (such as an administrator or subscriber) requests the affected post, the plugin retrieves the malicious metadata and prints it verbatim within an inline style element in the HTML source.\nUpon receipt of the page, the browser interprets the injected tags, causing the malicious script to execute in the victim's session. Since the script executes in the origin of the WordPress site, it inherits the capability to access sensitive information, including session tokens stored in document.cookie, interact with the DOM, and perform administrative actions via XHR or Fetch API requests on behalf of the victim.\nThis cross-site scripting vector is particularly dangerous because it persists across page reloads and remains active until the malicious content is manually removed by an authorized user, providing a persistent mechanism for the attacker to conduct further exploitation."
}