Description

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-25T04:17:31.093Z",
  "pubdate": "2026-09-25T04:17:31.093Z",
  "executiveSummary": "The CSS & JavaScript Toolbox plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 12.0.6.\nThe vulnerability arises from improper sanitization and escaping of attributes within the 'cjtoolbox' shortcode.\nSuccessful exploitation allows authenticated attackers with contributor-level privileges or higher to inject malicious JavaScript into web pages.\nWhen a victim, including administrators, views a page containing the malicious shortcode, the injected payload executes within the context of the user's browser session.\nThis creates a significant risk of session hijacking, unauthorized actions performed on behalf of the victim, or content manipulation.\nExploitation requires authenticated access to the WordPress dashboard, specifically the ability to create or edit content where shortcodes can be inserted.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS) due to the application's failure to adequately sanitize user-supplied input or encode output for the 'cjtoolbox' shortcode attributes.\nThe root cause lies in the insufficient server-side validation and context-aware output escaping logic within the plugin's shortcode handler.\nWhen a user with contributor-level privileges or higher inserts a 'cjtoolbox' shortcode into a post or page, the plugin processes the provided attributes. Because the plugin does not properly neutralize malicious payloads embedded within these attributes, the unsanitized input is stored directly in the WordPress database.\nThe attack flow proceeds as follows: First, an attacker with sufficient privileges creates a new post or edits an existing one, injecting a crafted 'cjtoolbox' shortcode containing a JavaScript payload within one of the attributes. Second, upon saving the content, the malicious string is persisted in the database. Third, whenever any user—including high-privileged administrators—navigates to the page where this shortcode is rendered, the WordPress engine processes the shortcode, and the plugin retrieves the stored, malicious attribute without secondary escaping.\nConsequently, the payload is reflected in the HTML response rendered by the browser. The browser interprets the injected script as legitimate content, leading to execution in the victim's security context.\nThe impact of this vulnerability is critical, as it allows for arbitrary script execution within the WordPress dashboard or the public-facing site. Attackers can leverage this to steal session cookies, perform unauthorized administrative actions, redirect users, or modify site content.\nThis vulnerability is present in versions up to and including 12.0.6 and does not require elevated administrative privileges for the initial injection, as contributor-level access is sufficient to include shortcodes in page content."
}