🚨 CVE-2026-81432
The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.
🎖@cveNotify
WPScan
JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF
See details on JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF CVE 2026-81432. View the latest Plugin Vulnerabilities on WPScan.
September 2, 2026 33
