Description

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-20T06:17:07.927Z",
  "pubdate": "2026-08-20T06:17:07.927Z",
  "executiveSummary": "An authenticated Stored Cross-Site Scripting (XSS) vulnerability has been identified in the GutenKit WordPress plugin prior to version 2.5.0. The vulnerability stems from insufficient sanitization of uploaded Scalable Vector Graphics (SVG) files across multiple upload paths enabled by the plugin.\nAn attacker possessing the file upload capability, such as a user with the Author role, can leverage this flaw by uploading a maliciously crafted SVG file containing embedded executable scripts.\nWhen a targeted user, including high-privileged accounts like administrators, opens or interacts with the uploaded SVG file within the application context, the malicious payload executes in the victim's browser.\nThis allows the execution of arbitrary JavaScript within the security context of the victim's session, potentially leading to privilege escalation, session hijacking, or unauthorized administrative actions.\nExploitation requires authenticated access with file upload privileges and successful delivery of the malicious SVG file to the target user or system.",
  "technicalDetails": "The vulnerability resides in the file upload handling mechanisms implemented by the GutenKit WordPress plugin prior to version 2.5.0. Specifically, the application fails to adequately sanitize or validate SVG files processed through all supported upload paths.\nSVG is an XML-based vector image format that supports interactive and animated content through the integration of embedded scripting languages, primarily ECMAScript/JavaScript, via elements such as <script>, event handlers like onload, or foreignObject tags.\nBecause the GutenKit plugin fails to strip potentially dangerous XML nodes, attributes, and script execution vectors during the file ingestion process, malicious payloads embedded within the SVG structure are stored directly on the server.\nThe attack flow begins when an authenticated user with low-level privileges, such as an Author who possesses standard media upload capabilities, crafts a malicious SVG file containing an XSS payload.\nThe attacker uploads this file through one of the vulnerable upload paths enabled by the GutenKit plugin. The server accepts and stores the file without applying rigorous sanitization or converting the SVG into a safe rasterized format.\nSubsequently, when another user—particularly an administrator—views, previews, or accesses the uploaded SVG file directly through the web browser, the browser parses the XML structure and executes the embedded JavaScript payload.\nBecause the script executes in the context of the victim's authenticated browser session, the payload inherits the privileges of the victim user.\nPost-exploitation impact depends on the privileges of the targeted victim. If an administrator is compromised, the attacker could execute administrative functions, create new administrative user accounts, modify site configurations, or inject persistent malware into the WordPress database."
}