GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor

Information

Software Type	Plugin
Software Slug	gutenkit-blocks-addon (view on wordpress.org)
Software Status	Active
Software Author	ataurr
Software Website	wpgutenkit.com
Software Downloads	792,413
Software Active Installs	80,000
Software Record Last Updated	October 10, 2026

8 Vulnerabilities

Submit a Vulnerability

GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'

6.4

CVE-2026-2573

Sep 2, 2026

Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777)

GutenKit <= 2.5.0 - Authenticated (Contributor+) Arbitrary CSS Injection

4.3

CVE-2026-19698

Sep 1, 2026

Researcher: Haitam Lazaar

GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor <= 2.4.15 - Authenticated (Contributor+) Information Exposure

4.3

CVE-2026-19699

Aug 21, 2026

Researcher: Shikhali Jamalzade

GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor < 2.5.0 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVE-2026-19697

Aug 21, 2026

Researcher: Yaswanth Reddy Sunkara

GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints

5.3

CVE-2026-15827

Jul 22, 2026

Researcher: Viet Anh Ngo

GutenKit <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2025-57900

Sep 22, 2025

Researcher: Prissy

GutenKit <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2025-46253

Apr 22, 2025

Researcher: Khalid Yusuf

GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload

9.8

CVE-2024-9234

Oct 10, 2024

Researcher: Sean Murphy

Title	Status	CVE ID	CVSS	Researchers	Date
GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'	Patched	CVE-2026-2573	6.4	Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777)	September 2, 2026
GutenKit <= 2.5.0 - Authenticated (Contributor+) Arbitrary CSS Injection	Patched	CVE-2026-19698	4.3	Haitam Lazaar	September 1, 2026
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor <= 2.4.15 - Authenticated (Contributor+) Information Exposure	Patched	CVE-2026-19699	4.3	Shikhali Jamalzade	August 21, 2026
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor < 2.5.0 - Authenticated (Author+) Stored Cross-Site Scripting	Patched	CVE-2026-19697	6.4	Yaswanth Reddy Sunkara	August 21, 2026
GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints	Patched	CVE-2026-15827	5.3	Viet Anh Ngo	July 22, 2026
GutenKit <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2025-57900	6.4	Prissy	September 22, 2025
GutenKit <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2025-46253	6.4	Khalid Yusuf	April 22, 2025
GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload	Patched	CVE-2024-9234	9.8	Sean Murphy	October 10, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation