CVE-2026-81432 — JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF

CVE-2026-81432

JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF PUBLISHED

Description (CNA)

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.

Affected (CNA)

Vendor / product	Versions
Unknown / JetStyleManager for Gutenberg	affected 0 before 1.3.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/ac6c4bce-9783-43ee-9549-41cbb2c3e9ac/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.