CVE-2026-19697Disclosure

LOWCVSS 6.8 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/d144679c-10ef-4a69-b0e9-fd9e18a2aafc/

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Infoflowcloud@infoflowcloud46d
Disclosure
🚨*CVE* CVE-2026-19697 The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability… https://www.cve.org/CVERecord?id=CVE-2026-19697 ----- Traducción: CVE-2026-19697 El … https://infoflow.cloud`
Post summary
The post highlights CVE‑2026‑19697, a bug in GutenKit WordPress plugin versions below 2.5.0 that fails to sanitize SVG uploads, allowing malicious file uploads, with no mention of PoC, exploit code, or active exploitation.
0000136
102 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-19697 The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability… https://www.cve.org/CVERecord?id=CVE-2026-19697
Post summary
The post announces CVE-2026-19697, detailing a sanitisation flaw in the GutenKit WordPress plugin that permits unsanitised SVG uploads. No PoC, exploit, patch, or active exploitation is reported.
00001816
58.0K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds46d
Disclosure
CVE-2026-19697 Stored XSS in GutenKit WordPress Plugin Before 2.5.0 via Unsanitized SVG Uploads https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-19697
Post summary
The entry announces that GutenKit WordPress plugin versions prior to 2.5.0 have a stored XSS flaw from unsanitized SVG uploads.
00000122
4.1K followersView on X

Explore more

Back to dashboard