CSS JavaScript Toolbox CVE-2025-14814

Requires an authenticated WordPress account with contributor-level privileges or higher (PR:L) on a site running CSS & JavaScript Toolbox version 12.0.6 or earlier, and the ability to use the plugin's cjtoolbox shortcode in post/page content. The injected script only triggers when another user subsequently views the page containing the malicious shortcode attribute. Limiting factors: exploitation is gated by the need for a valid contributor+ account (not open to anonymous internet attackers), so sites that do not allow untrusted user registration/contributor roles face substantially lower risk; impact is realized only when a victim visits the injected page.

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4) shows network-exploitable stored XSS requiring only low privileges (contributor-level WordPress account), no user interaction to inject, with a scope change (S:C) reflecting script execution in other users' browser contexts and limited (Low) confidentiality/integrity impact. The barrier is the authentication requirement: an attacker needs a valid contributor+ account, which limits mass, unauthenticated exploitation. No EPSS score, no CISA KEV listing, and no public exploit code are provided in the input, so there is no evidence of active or automated exploitation - this is a targeted, insider- or account-compromise-dependent XSS, not a wormable remote takeover. A patch exists (WordPress plugin repository changeset 3667323), which lowers real-world risk for sites that update. Net: prioritize patching on multi-author WordPress sites where untrusted users hold contributor accounts, but this is not a drop-everything vulnerability. Note the absence of EPSS/KEV/POC signals means exploitation likelihood is inferred from the vector alone.

An attacker who has registered or compromised a contributor-level WordPress account crafts a post or page containing the cjtoolbox shortcode with a malicious attribute carrying a JavaScript payload. Because attributes are neither sanitized nor escaped, the stored script executes in the browser of any user - including administrators - who later views the injected page, enabling session/cookie theft or admin-context actions. No public exploit code is identified in the provided data, but the technique is trivial and well-understood.