Css Javascript Toolbox Vulnerabilities

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, t...

CVSS:

4.4

Affected:

up to 12.0.5

Fixed in:

12.0.6

Disclosed:

Oct 31, 2025

CVE-2025-11928 on NVD →

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Local File Inclusion in versions up to 12.0.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This...

CVSS:

7.5

Affected:

up to 12.0.3

Fixed in:

12.0.3

Disclosed:

Jul 22, 2025

CVE-2025-3703 on NVD →

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 11.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contribu...

CVSS:

6.4

Affected:

up to 11.8

Fixed in:

11.9

Disclosed:

Dec 19, 2023

CVE-2023-50823 on NVD →

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 8.4.1 by accessing '/wp-content/plugins/css-javascript-toolbox/models/uninstall/db/mysql/uninstall.sql' on a vulnerable sites. This can allow unauthenticated attackers to extract sensitive data s...

CVSS:

5.8

Affected:

up to 8.4.1

Fixed in:

8.4.2

Disclosed:

Dec 8, 2018