Stored Cross-Site Scripting Vulnerability in CSS & JavaScript Toolbox Plugin for WordPress

CVE-2025-13533

What is CVE-2025-13533?

The CSS & JavaScript Toolbox plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping in the Assignment Engine fields. This security flaw affects all versions up to and including 12.0.6. Authenticated users with Administrator-level access can exploit this vulnerability by injecting malicious scripts into assignment data fields such as Expressions, URLs, and Advanced assignment data. Consequently, when a user accesses the CJT block edit screen in the admin dashboard, these scripts could execute, posing a significant security risk.

References