CVE-2026-65484
MediumCVSS 6.3Summary
The Style Kits plugin versions up to 2.6.5 contain a contributor broken access control vulnerability. An attacker with contributor privileges can bypass access control mechanisms.
Risk Assessment
A user with contributor role may gain unauthorized access to functions or data, potentially leading to privilege escalation or information disclosure.
Recommendation
Immediately update the Style Kits plugin to the latest available version.
Other vulnerabilities in Style Kits
See all- CVE-2026-27364Medium
Style Kits versions up to 2.6.5 have a Subscriber Broken Access Control vulnerability, allowing subscribers to access unauthorized functionality.
- CVE-2026-6565Medium
The Style Kits plugin for WordPress up to version 2.5.0 has a Stored XSS vulnerability via the kit title parameter in the '/wp-json/agwp/v1/tokens/save' endpoint. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever a user visits an infected page.
Original NVD description (English source)
Contributor Broken Access Control in Style Kits <= 2.6.5 versions.