CVE-2026-88788: Text Styler <= 1.1.1 - Contributor+ Stored XSS
The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that executes in the browser of anyone viewing the affected post, including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with contributor-level access or higher can exploit it. The issue also lacks verification that the user is permitted to edit the targeted post, so the attacker may target posts they are not authorized to edit.
Who is exposed to the stored script?
Anyone who views an affected post can have the injected JavaScript execute in their browser. This includes administrators viewing the post.
Are installations affected by default?
The provided information identifies Text Styler versions through 1.1.1 as affected, but does not state whether a specific default configuration or feature use is required.