Description

Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-09T12:17:11.213Z",
  "pubdate": "2026-10-09T12:17:11.213Z",
  "executiveSummary": "The unFocus Projects Scripts n Styles WordPress plugin, up to and including version 3.5.8, is vulnerable to a critical Missing Authorization security flaw. This vulnerability allows remote attackers to exploit incorrectly configured access control security levels within the application. Because the plugin does not adequately restrict or validate authorization checks for administrative or sensitive operations, unauthorized users can interact with restricted functionalities. The risk implication of this vulnerability is significant, as it can allow low-privileged users to execute actions that should be restricted to high-privileged administrators.\nDepending on the exact endpoints exposed, this could lead to arbitrary script injection, site defacement, or total site compromise. Since the Scripts n Styles plugin is designed to allow users to add custom CSS and JavaScript to WordPress pages, unauthorized access to these settings effectively permits attackers to inject malicious payloads directly into the site's frontend, leading to Cross-Site Scripting (XSS) or malicious redirects. To exploit this vulnerability, an attacker typically needs some level of access or must target exposed endpoints that lack proper permission verification, taking advantage of the flawed access control architecture present in the affected versions.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of robust authorization checks within the backend scripts and style management endpoints of the unFocus Projects Scripts n Styles plugin (versions up to and including 3.5.8). In WordPress environments, plugins often register custom AJAX actions or REST API endpoints to handle administrative tasks, such as saving global or page-specific custom CSS and JavaScript. Security best practices require validating both the authenticity of the request (using nonces) and the authorization level of the user (using capabilities checks, such as current_user_can). In the affected versions of Scripts n Styles, these critical authorization checks are either entirely missing or incorrectly configured, allowing requests from unauthorized users to bypass security boundaries.\nAn attacker can exploit this misconfiguration by mapping the application's exposed endpoints, specifically those associated with saving or updating scripts. The attack flow begins with the reconnaissance phase, where an attacker identifies a WordPress site utilizing an active, vulnerable version of the Scripts n Styles plugin. The attacker then targets the endpoint responsible for script configuration modifications. Since authorization is not enforced, even low-privileged users (such as subscribers) or, in some scenarios, unauthenticated external actors can craft malicious HTTP POST requests containing payload data.\nThe payload typically consists of custom JavaScript intended to execute in the security context of other users' browsers. When the server receives this unauthorized request, it processes the parameters and updates the plugin's configuration database option or updates page metadata. Once saved, these malicious scripts are injected dynamically into the headers or footers of the targeted WordPress pages.\nThe post-exploitation impact of this vulnerability is severe. Whenever an administrator or regular visitor accesses the affected pages, the injected script executes automatically. This enables attackers to perform session hijacking, harvest sensitive credentials via forged login overlays, redirect users to malicious external domains, or initiate unauthorized administrative actions on behalf of logged-in administrators. The vulnerability fundamentally undermines the integrity and confidentiality of the host website by failing to restrict powerful script-injection capabilities to trusted administrators."
}