Executive brief
The Text Styler WordPress plugin allows contributors and higher-privilege users to inject malicious JavaScript through styling fields, which then executes when administrators or other site visitors view the affected post. An attacker with contributor access can inject JavaScript that runs in the browser of anyone viewing the post, potentially leading to account takeover of administrators or data theft.
Technical details
The plugin fails to sanitize and escape user-supplied styling values before outputting them in front-end style blocks, and does not verify post-editing permissions. Users with contributor-level access or above can inject arbitrary JavaScript that persists in the database and executes in the context of any user viewing the post, including administrators. The vulnerability is a stored cross-site scripting (XSS) flaw requiring authentication but no additional user interaction.
Affected products
- Realtyna Text Styler through 1.1.1
Timeline
- 2026-09-22: disclosed: Published as CVE-2026-88788
- 2026-09-19: other: Publicly published on WPScan
- 2026-09-12: other: Added to vulnerability databases