The Text Styler WordPress plugin is vulnerable to stored cross-site scripting, which allows authenticated attackers to execute malicious JavaScript in the browsers of other users, including administrators.

This vulnerability is a stored cross-site scripting (CWE-79) flaw caused by improper sanitization of styling inputs. It requires an attacker to possess at least contributor-level privileges to inject malicious scripts that execute when a victim views the compromised post.

Successful exploitation permits unauthorized script execution within the context of an administrator or other high-privileged user session. This can lead to complete account takeover, unauthorized modification of site content, or the redirection of site traffic, which significantly undermines the integrity and confidentiality of the WordPress environment. While the CVSS score of 6.8 reflects a medium severity, the ability to target administrative accounts elevates the operational risk to the organization.

Immediate Action: As no specific patch version is currently identified, administrators should immediately deactivate and remove the Text Styler plugin until the vendor releases a security update that addresses the sanitization and capability check failures.

Proactive Monitoring: Review WordPress user activity logs for suspicious changes to post content, particularly those involving unconventional styling attributes or scripts injected by accounts with contributor privileges.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust XSS filtering rules to detect and block malicious payloads attempting to reach the plugin's vulnerable input fields.

Public Exploit Available: Unknown

Given the potential for privilege escalation via administrative session compromise, administrators must prioritize the removal of the vulnerable plugin from production environments. Organizations should monitor vendor communications closely for a formal patch and ensure that strict user role management is enforced to limit the number of accounts with contributor access.