CVE-2026-81432
Medium
Description
The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.
SeverityMedium
CVSS4.3
Exploit probability—
ProductJetStyleManager for Gutenberg
PublishedSep 2, 2026
First seenSep 2, 2026
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- JetStyleManager for Gutenberg1.3.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| JetStyleManager for Gutenberg | v < 1.3.9 | 1.3.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.