Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88788

Text Styler <= 1.1.1 - Contributor+ Stored XSS

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88788

Published

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that executes in the browser of anyone viewing the affected post, including administrators.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88788

Published

Text Styler

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Text Styler",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "0",
                            "lessThanOrEqual": "1.1.1"
                        }
                    ],
                    "defaultStatus": "unknown"
                }

Original source record · Cite this exact observation · Complete original publisher JSON