CVE-2026-115250: Text Typing < 2.2.2 - Contributor+ Stored XSS
The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress Contributor role or any higher-privileged role can exploit it. Exploitation requires that user to create or modify content containing the affected block attribute.
Who is exposed to the malicious script?
Anyone who views an affected page may have the stored script execute in their browser. The issue therefore affects sites where Contributor-or-higher accounts are not fully trusted.
Are administrators required to trigger the attack?
No. The vulnerable content is rendered when an affected page is viewed, so any visitor viewing that page can trigger execution in their own browser.
What version resolves the issue?
Update Text Typing to version 2.2.2 or later. Versions before 2.2.2 are affected according to the available information.