Text Styler EUVD-2026-84275

Requires an authenticated WordPress account with contributor-level capabilities or above on a site running the Text Styler plugin through version 1.1.1; the attacker stores JavaScript in a Text Styler styling value that the plugin outputs unescaped inside a front-end style block, and no edit-post capability check blocks it. Exploitation is LIMITED by: needing a valid contributor+ account (authenticated), requiring a victim to view the affected post for the payload to fire (UI:R), and being confined to sites that have this specific niche plugin installed. It does not work against unauthenticated visitors as an attacker and is not exploitable against default installs lacking the plugin.

This is a moderate-risk stored XSS (CWE-79) that requires authentication. The vendor/WPScan CVSS is 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H), but several metrics look mis-set for a stored-XSS-in-plugin: the description says exploitation needs only 'contributor-level access or above,' which is a low-privilege authenticated role, so PR:H overstates the bar - PR:L is more accurate. Likewise the payload executes in a viewing user's browser (a different security scope than the vulnerable component), so S:U is arguably wrong and S:C is more defensible, and C:H/I:H/A:H is inflated for reflected-in-DOM script execution (C:L/I:L/A:N is typical for XSS). A public exploit exists (WPScan), so this is 'publicly available exploit code exists' - but note POC availability is NOT the same as active exploitation: there is no EPSS score, no CISA KEV listing, and no SSVC data provided, so there is no evidence of automated or in-the-wild exploitation. Net: a real but bounded issue - it demands an authenticated contributor account and a victim viewing the post - making it a targeted/insider or account-compromise vector rather than a mass-exploitable internet-facing flaw. Data conflict to verify with vendor: the CVSS impact and privilege metrics (PR:H, S:U, C/I/A:H) are inconsistent with a contributor-triggerable stored XSS as described.

An attacker who holds (or phishes/registers into) a contributor-level WordPress account submits a post whose Text Styler styling values contain a JavaScript payload; because the plugin neither sanitizes the value nor checks edit-post capability, the script is stored and served inside a front-end style block. When an administrator or other visitor views the post, the script runs in their browser session, enabling session/cookie theft or admin-context actions. A public exploit is available via WPScan, lowering the effort to reproduce.