Text Styler
Monthly
Stored cross-site scripting in the Text Styler WordPress plugin (all versions through 1.1.1) allows an authenticated user with contributor-level capabilities or above to save JavaScript inside a styling value that the plugin renders unescaped in a front-end style block, so the payload executes in the browser of anyone who views the affected post - including administrators. A secondary defect compounds the issue: the plugin does not verify that the user is permitted to edit the target post, so a low-privileged contributor can plant the payload on content they do not own. Exploitation requires only a valid contributor+ account and a victim viewing the crafted post (UI:R) on a site with this niche plugin installed; publicly available exploit code exists, and no public exploit is confirmed as actively exploited and the flaw is not listed in CISA KEV. Our independent assessment rates this moderate risk at CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in the Text Styler WordPress plugin (all versions through 1.1.1) allows an authenticated user with contributor-level capabilities or above to save JavaScript inside a styling value that the plugin renders unescaped in a front-end style block, so the payload executes in the browser of anyone who views the affected post - including administrators. A secondary defect compounds the issue: the plugin does not verify that the user is permitted to edit the target post, so a low-privileged contributor can plant the payload on content they do not own. Exploitation requires only a valid contributor+ account and a victim viewing the crafted post (UI:R) on a site with this niche plugin installed; publicly available exploit code exists, and no public exploit is confirmed as actively exploited and the flaw is not listed in CISA KEV. Our independent assessment rates this moderate risk at CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.