Stored Cross-Site Scripting in Just Highlight Plugin for WordPress

CVE-2025-13311

What is CVE-2025-13311?

The Just Highlight plugin for WordPress has a security flaw due to inadequate input sanitization and output escaping in the 'Highlight Color' setting. This vulnerability allows authenticated attackers with administrator-level permissions to inject malicious web scripts. These scripts could execute on the pages viewed by users accessing the plugin's settings, potentially compromising site integrity and user data. It is crucial to update to version 1.0.4 or later to mitigate this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References