CVE-2025-11928

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11928", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-17T20:48:12.035Z", "datePublished": "2025-11-01T03:34:36.948Z", "dateUpdated": "2026-04-08T17:12:38.873Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:38.873Z"}, "affected": [{"vendor": "wipeoutmedia", "product": "CSS & JavaScript Toolbox", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "12.0.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "CSS & JavaScript Toolbox <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a26c71d6-9840-450e-90cd-c20de53f5cb5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3385887%40css-javascript-toolbox&new=3385887%40css-javascript-toolbox&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Chairat Toraya"}], "timeline": [{"time": "2025-10-24T11:16:43.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-31T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T14:59:06.014393Z", "id": "CVE-2025-11928", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T14:59:13.017Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11928", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T14:59:06.014393Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T14:59:09.935Z"}}], "cna": {"title": "CSS & JavaScript Toolbox <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Chairat Toraya"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wipeoutmedia", "product": "CSS & JavaScript Toolbox", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.0.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-24T11:16:43.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-31T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a26c71d6-9840-450e-90cd-c20de53f5cb5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3385887%40css-javascript-toolbox&new=3385887%40css-javascript-toolbox&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:38.873Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11928", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:12:38.873Z", "dateReserved": "2025-10-17T20:48:12.035Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-01T03:34:36.948Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CSS & JavaScript Toolbox", "vendor": "wipeoutmedia", "versions": [{"lessThanOrEqual": "12.0.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin CSS & JavaScript Toolbox para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n de administrador en todas las versiones hasta la 12.0.5, inclusive, debido a la sanitizaci\u00f3n insuficiente de entradas y al escape de salidas. Esto hace posible que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio e instalaciones donde 'unfiltered_html' ha sido deshabilitado."}], "id": "CVE-2025-11928", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11928", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T14:59:06.014393Z", "version": "2.0.3"}}]}, "published": "2025-11-01T04:16:02.970", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3385887%40css-javascript-toolbox&new=3385887%40css-javascript-toolbox&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a26c71d6-9840-450e-90cd-c20de53f5cb5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:59:00.735025+00:00", "value": {"mitigation_remediation": ["Install the latest version of the CSS & JavaScript Toolbox plugin (12.0.6 or newer).", "If you cannot upgrade immediately, disable or uninstall the plugin to block the stored XSS vector.", "Apply the principle of least privilege and restrict administrative permissions to the minimal set of users that truly require them."], "summary": {"action": "Patch plugin", "impact": "Stored Cross\u2011Site Scripting affecting privileged users"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed wipeoutmedia\u2019s CSS & JavaScript Toolbox plugin, in any version up to and including 12.0.5. The vulnerability is only exploitable on multi\u2011site networks and when the WordPress option unfiltered_html is turned off for administrator-level accounts.", "description_and_impact": "The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to stored cross\u2011site scripting. The flaw arises from insufficient input sanitization and output escaping in the admin settings interface. An attacker who has administrator or higher privileges can inject arbitrary JavaScript in the values entered for the plugin's settings, which is then rendered on any page that invokes the plugin. This enables malicious code to run in the browsers of all users who view the affected page, potentially exposing credentials, defacing content, or facilitating further attacks.", "risk_and_exploitability": "The CVSS base score is 4.4 and the EPSS indicates a very low probability (<\u202f1\u202f%) of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. Nonetheless, exploitation requires only an authenticated admin account and can be achieved by updating the stored settings in the plugin\u2019s UI, after which the malicious script executes automatically for every user who accesses a page that uses the plugin. Because it is limited to privileged users, the overall impact may be moderate, but the ability to run arbitrary code on the client side makes it a significant threat for sites relying on this plugin for styling or functionality."}}}}, "created": "2025-11-03T10:43:40.630342+00:00", "updated": "2026-04-21T02:00:12.331907+00:00", "vendors": ["wipeoutmedia", "wipeoutmedia$PRODUCT$css_&_javascript_toolbox", "wordpress", "wordpress$PRODUCT$wordpress"]}