Security Alert Summary
The Text Styler WordPress plugin through 1.1.1 fails to sanitise and escape user-supplied styling values before outputting them in a front-end style block and does not verify that a user may edit the target post. This allows users with contributor-level access or higher to store JavaScript that can execute in the browser of anyone viewing the affected post, including administrators.
CVE Details
- CVE ID:
CVE-2026-88788 - Affected component: Text Styler WordPress plugin
- Affected versions: through 1.1.1 (<= 1.1.1)
- Published: September 22, 2026 at 06:16:49 AM UTC
- Last modified: September 22, 2026 at 11:17:25 AM UTC
- CVSS v3.1: Base score 6.8, Severity MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: HIGH
- User Interaction: REQUIRED
- Scope: UNCHANGED
- Vector:
- Primary impact:
- Confidentiality: HIGH
- Integrity: HIGH
- Availability: HIGH
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The plugin outputs user-supplied styling values inside a front-end style block without proper sanitisation and escaping, and it does not verify whether the submitting user is permitted to edit the targeted post. Because styling values are rendered on the front end, an attacker with contributor-level access or above can store JavaScript that will execute in the browser of any visitor viewing the affected post, including administrators.
The issue is rooted in missing input validation and missing authorization checks for post edit permissions before user-supplied styling is persisted and output. The CVE description does not name specific functions or REST endpoints; the observable failures are lack of sanitisation/escaping of styling values and lack of verification that a user may edit the target post.
Impact is limited to actions that can be performed via injected script in the context of a page view (for example, theft of session-exposed data visible to the browser, DOM manipulation, or actions performed by an authenticated user in their browser). The description does not indicate remote code execution on the server or direct compromise of server-side resources.
How This Could Impact Your Website
Consider a site with several roles: the site owner, internal staff editors, and external contractors or contributors. If a contributor is able to submit styling values that include script, that script can run in the browser of anyone viewing the post. In a realistic scenario, a malicious or compromised contributor account could inject JavaScript that harvests visible user data (such as author names or email addresses displayed on the page), captures administrator session actions performed in the browser, or modifies page content to present phishing links targeting staff or contractors.
Practical consequences include exposure of internal user email addresses and an increased risk of targeted phishing or social engineering against staff and administrators. If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, especially post edits and newly added styling or script content.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
