Vulnerabilities

TI-2025-13518 CVE-2025-14814 · GHSA-p952-qfrp-qv9h

CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode

LOW 27

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00152 Published 2026-09-25 No fix listed CWE-79

TI-2025-12364 CVE-2025-13533 · GHSA-6jx6-9xqq-pg98

Cross-site scripting in wipeoutmedia CSS & JavaScript Toolbox

LOW 20

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00311 Published 2026-09-18 No fix listed CWE-79

TI-2025-10937 CVE-2025-11928 · GHSA-f2cq-gqfx-m35m

CSS & JavaScript Toolbox <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting

LOW 20

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.0019 Published 2025-11-01 No fix listed CWE-79

TI-2025-03262 CVE-2025-3703 · GHSA-3hx8-v7h4-vj64

WordPress CSS & JavaScript Toolbox plugin < 12.0.3 - Local File Inclusion vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wipeoutmedia CSS & JavaScript Toolbox css-javascript-toolbox allows PHP Local File Inclusion.This i…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00666 Published 2025-08-14 No fix listed CWE-98

TI-2023-27728 CVE-2023-50823 · GHSA-29rj-6gfr-wmfc

WordPress CSS & JavaScript Toolbox Plugin <= 11.7 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wipeout Media CSS & JavaScript Toolbox allows Stored XSS.This issue affects CSS & JavaScript Toolbox: from n/a through…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00328 Published 2023-12-21 No fix listed CWE-79