Description

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-02T15:17:37.990Z",
  "pubdate": "2026-09-02T15:17:37.990Z",
  "executiveSummary": "The GutenKit WordPress plugin, in versions prior to 2.5.1, is susceptible to a Stored Cross-Site Style (CSS) Injection vulnerability. This security flaw stems from insufficient input validation and output encoding of style settings managed within the plugin's framework.\nBy manipulating style configurations, an authenticated user possessing the Contributor role or higher can inject arbitrary CSS payloads that are subsequently rendered on the front end of the website. Because these settings are persisted in the database and applied globally or per-post, the malicious styles are executed whenever an unsuspecting user or an anonymous visitor accesses the affected page.\nThe primary impact of this vulnerability is the potential for website defacement, interface redressing (UI spoofing), and the forced loading of external resources through CSS-based vectors. While the current execution context limits the threat to CSS manipulation—thereby excluding the execution of arbitrary JavaScript—the ability to alter the visual presentation and perform unauthorized resource fetching poses a significant risk to site integrity and visitor experience. Successful exploitation requires an account with at least Contributor-level privileges; no specialized network conditions or additional prerequisites are necessary for the payload to reach the rendered output.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied style data during the save-and-render lifecycle within the GutenKit plugin. Specifically, the plugin architecture fails to sanitize or validate CSS properties before storing them in the WordPress database or reflecting them within the generated CSS output on the front end.\nThe exploitation process begins when a user with the Contributor role—or any higher-privileged role—accesses the plugin’s style settings interface. The interface allows users to define custom CSS parameters associated with a post or block. Because the plugin does not enforce strict allow-lists or perform sanitization on these inputs, an attacker can supply malicious CSS directives. For example, an attacker could input CSS rules that overwrite page layout elements, hide critical security warnings, or force the browser to initiate requests to external servers via properties like 'background-image' or 'list-style-image'.\nOnce the payload is saved, the vulnerable component retrieves the malicious style data from the database. When the front-end rendering engine constructs the style blocks or inline CSS for the page, it embeds the attacker-supplied, unescaped payload directly into the document’s DOM. When a visitor subsequently views the affected page, their browser interprets the injected CSS, applying the attacker's modifications to the rendered document.\nFrom an attack flow perspective, the sequence is: 1) The attacker authenticates as a Contributor or higher. 2) The attacker interacts with the GutenKit plugin settings, injecting CSS-based payloads into the style configuration fields. 3) The plugin fails to validate these inputs and commits them to the WordPress database. 4) The server-side code fetches the contaminated data during the page rendering phase. 5) The front-end output includes the malicious style block. 6) The victim's browser executes the CSS, resulting in interface redressing or unauthorized resource loading.\nThe scope of the impact is constrained by the nature of CSS injection; however, attackers can successfully engage in UI spoofing—such as overlaying transparent elements or creating convincing 'phishing' overlays—and potential data exfiltration through CSS side-channels (e.g., attribute selectors triggering external resource loads). By forcing the browser to fetch resources from an attacker-controlled endpoint, the vulnerability can also be leveraged for tracking or server-side request verification. The lack of JavaScript execution prevents traditional XSS-based session hijacking, but the potential for malicious visual modification remains high."
}