Text Toggle
Monthly
The Text Toggle WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 1.1 affecting the 'title' shortcode attribute of the [tt_part] and [tt] shortcodes. Authenticated attackers with Contributor-level privileges or above can inject arbitrary HTML attributes and event handlers by breaking out of the title attribute context, allowing malicious scripts to execute in the browsers of any user viewing affected pages. The vulnerability is classified as medium severity (CVSS 6.4) and requires authentication, but impacts site integrity and visitor security across any WordPress installation using this plugin.
The Text Toggle WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 1.1 affecting the 'title' shortcode attribute of the [tt_part] and [tt] shortcodes. Authenticated attackers with Contributor-level privileges or above can inject arbitrary HTML attributes and event handlers by breaking out of the title attribute context, allowing malicious scripts to execute in the browsers of any user viewing affected pages. The vulnerability is classified as medium severity (CVSS 6.4) and requires authentication, but impacts site integrity and visitor security across any WordPress installation using this plugin.