CVE-2026-19698: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GutenKit

CVE-2026-19698 is an injection vulnerability (CWE-74) in the GutenKit WordPress plugin prior to version 2.5.1. The plugin fails to validate or escape style settings saved against posts before incorporating them into front-end CSS output. This flaw allows users with Contributor or higher privileges to inject arbitrary CSS code, which can affect the appearance and behavior of pages served to other users and anonymous visitors. The vulnerability does not permit JavaScript execution at the Contributor role, thus restricting the impact to CSS-based attacks such as defacement and interface redressing.

The vulnerability allows limited CSS injection by users with Contributor role or above, potentially leading to visual defacement, interface manipulation, and forced loading of external resources on pages viewed by others. There is no ability to execute JavaScript, so the risk of more severe attacks like cross-site scripting is not present. The overall confidentiality and availability impacts are low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects versions before 2.5.1, so upgrading to version 2.5.1 or later is expected to address the issue once the vendor releases an official fix. Until then, restrict Contributor role permissions or avoid using vulnerable versions if possible.