All packages
Style Kits vulnerabilities
3 known CVE vulnerabilities in Style Kits, translated and rated.
- CVE-2026-65484Medium
The Style Kits plugin versions up to 2.6.5 contain a contributor broken access control vulnerability. An attacker with contributor privileges can bypass access control mechanisms.
- CVE-2026-27364Medium
Style Kits versions up to 2.6.5 have a Subscriber Broken Access Control vulnerability, allowing subscribers to access unauthorized functionality.
- CVE-2026-6565Medium
The Style Kits plugin for WordPress up to version 2.5.0 has a Stored XSS vulnerability via the kit title parameter in the '/wp-json/agwp/v1/tokens/save' endpoint. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever a user visits an infected page.