Description

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that executes in the browser of anyone viewing the affected post, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-22T06:16:49.777Z",
  "pubdate": "2026-09-22T06:16:49.777Z",
  "executiveSummary": "The Text Styler WordPress plugin through version 1.1.1 contains a Stored Cross-Site Scripting (XSS) vulnerability.\nThis flaw originates from the failure to properly sanitize and escape user-supplied styling attributes before rendering them within front-end style blocks.\nThe vulnerability is exacerbated by an absence of authorization checks, allowing users with contributor-level privileges or higher to inject and execute arbitrary JavaScript.\nThe attack is triggered when an administrator or any other authenticated user views a post containing the malicious payload, leading to potential account takeover, session hijacking, or unauthorized administrative actions.\nBecause the payload is stored persistently in the database, the impact is significant, as it affects any visitor viewing the compromised post content.\nThis vulnerability represents a critical security risk for WordPress environments where contributors are permitted, as it bypasses standard privilege restrictions through client-side script execution.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of styling metadata within the Text Styler plugin. The plugin fails to apply input sanitization or output escaping mechanisms to user-provided styling values before these values are rendered inside HTML style blocks.\nIn the WordPress architecture, the plugin processes these styling attributes during the rendering phase of a post. Because the plugin does not validate whether the authenticated user has the necessary permissions to modify the specific post content, a user with the 'contributor' role can inject malicious payloads into these styling fields.\nThe attack flow begins when an attacker, authenticated with at least contributor-level privileges, crafts a malicious payload containing JavaScript code disguised as CSS properties or values. By injecting a string such as ';}alert(document.cookie);{//', the attacker can break out of the intended style context and execute arbitrary JavaScript in the victim's browser session.\nOnce the payload is saved into the post data, it becomes persistent in the database. When the target post is accessed, the plugin retrieves the malicious input and reflects it directly into the DOM of the affected web page without modification.\nWhen an administrator or authorized user views the post, the browser interprets the injected JavaScript. This leads to the execution of malicious code within the context of the victim's authenticated session.\nThe post-exploitation impact includes the potential for session hijacking, where the attacker steals the session cookie to bypass authentication, or the execution of unauthorized administrative actions (e.g., creating new administrative users, modifying site settings, or installing malicious plugins).\nThis vulnerability is classified as Stored XSS due to the persistence of the payload on the server. The lack of an 'edit_post' capability check ensures that the plugin will process and store styling data regardless of the user's authority to modify the specific content, effectively escalating the impact of low-privileged accounts to that of a full administrative compromise."
}