CSS & JavaScript Toolbox CVE-2025-13533

Requires an authenticated WordPress user with Administrator-level access or above to store the payload in the CSS & JavaScript Toolbox 'Assignment Engine' fields - specifically Expressions, URLs, or Advanced assignment data. Execution is further gated on a user (in practice another admin-area user) subsequently opening the CJT block edit screen in the wp-admin dashboard. Limiting factors: highest-privilege injection prerequisite (PR:H), admin-only victim surface, and the fact that an Administrator can already legitimately inject scripts through this plugin's intended functionality, sharply reducing added impact. Affects all versions up to and including 12.0.6.

This is a low-priority issue despite the CWE-79 stored XSS classification. The vendor CVSS of 4.4 (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) is driven down by PR:H, which the description substantiates: exploitation requires Administrator-level access or above to write the malicious payload into the Assignment Engine fields (Expressions, URLs, Advanced assignment data). No EPSS score, no CISA KEV listing, and no public exploit code were provided - so this is 'no public exploit identified at time of analysis.' The payload only fires when a user opens the CJT block edit screen inside the wp-admin dashboard, meaning both the injector and the victim are privileged admin-area users; this is effectively an admin-on-admin (near-self-XSS) condition with little privilege gain, since an Administrator can already inject arbitrary JS/CSS via this plugin's core function. The vendor's UI:N is questionable - the description explicitly conditions execution on a user navigating to the block edit screen, which is user interaction; I assess UI:R. The S:C (scope change) is defensible for browser-context XSS crossing the plugin's security authority. Net: real but low real-world risk, gated behind the highest privilege tier.

An attacker who has already obtained WordPress Administrator access (e.g., via a compromised admin account or a second-stage foothold) injects a malicious script into an Assignment Engine field such as an Expression or URL. The stored payload then executes in the browser of any admin who later opens the CJT block edit screen, enabling session/cookie theft or admin-dashboard actions. No public POC was provided in the input.