The GutenKit WordPress plugin, prior to version 2.5.5, fails to sanitize custom CSS entered in page settings. A user with the Author role or higher can embed JavaScript that escapes the style element and is stored in the post. When a visitor loads the published page, the malicious script executes in the visitor’s browser, enabling full client‑side compromise, including session hijacking, cookie theft, or redirection to phishing sites. The flaw represents a classic stored cross‑site scripting weakness.

Any WordPress site using the GutenKit plugin in its 2.5.0 through 2.5.4 releases, running WordPress versions below 7.0, is affected. The plugin vendor is listed as Unknown:GutenKit, indicating an unregistered or third‑party developer.

There is no CVSS score or EPSS data available, but the vulnerability is exploitable by any author‑level user on the site without external access, making it trivial to launch the attack. Because the malicious code runs in every visitor’s browser, the impact is potentially global. The vulnerability is not included in CISA’s KEV catalogue, yet the ease of exploitation and wide impact warrant rapid remediation.