Security Alert Summary
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin contains a stored cross-site scripting (XSS) vulnerability via the postBodyCss parameter in versions up to and including 2.4.4. Authenticated users with Contributor-level access or higher can inject scripts that execute when an injected page is viewed.
CVE Details
- CVE ID: CVE-2026-2573
- Affected component: GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor (plugin)
- Affected versions: All versions up to and including 2.4.4
- Published: September 3, 2026 at 1:05:06 PM UTC
- Last modified: September 3, 2026 at 3:17:22 PM UTC
- CVSS v3.1 base score: 6.4 (MEDIUM)
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: Requires authenticated user with low privileges (Contributor-level or higher); no user interaction required
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The plugin fails to sufficiently sanitize and escape input provided via the postBodyCss parameter. Because input is stored and later rendered in pages, an authenticated user with Contributor-level access or higher can insert malicious HTML or JavaScript that is persisted in page content. When another user views the page, the injected script can execute in the context of that users browser.
This is a stored (persistent) cross-site scripting issue. The vulnerability exists due to insufficient input sanitization and missing or incomplete output escaping for the postBodyCss parameter. The CVE description does not identify specific functions or REST API endpoints beyond naming the parameter.
Impact is limited to actions achievable via script execution in a viewing user’s browser. This can include reading data accessible to the page context (such as visible content), performing actions available to that user in the browser, or modifying page presentation. The documented CVSS impacts are limited to low confidentiality and integrity effects and no availability impact.
How This Could Impact Your Website
Consider a small team managing a WordPress site: the site owner, an editor who publishes content, and a contributor who submits drafts. If a contributor is able to inject a script via postBodyCss, that script could run when an editor or any other site visitor views the affected page. Practical consequences include exposure of internal user-visible data (for example, email addresses shown on pages or in page markup) and increased risk of targeted phishing or social engineering against staff whose browsers executed the injected script.
For example, an attacker with contributor access could insert a script that steals tokens or auto-fills from forms visible to an administrator viewing the page, or that modifies page content to include malicious links used in phishing. The documented CVSS impacts indicate limited confidentiality and integrity impact rather than full site compromise, so effects are focused on data leakage and content tampering within the page context.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles; limit Contributor-level access where possible.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, including unexpected content edits or new pages.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/changeset/3468273/gutenkit-blocks-addon
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7e94cbf8-c74a-4546-83de-b5c5b094762b?source=cve
