CVE-2025-11928 Overview
CVE-2025-11928 is a stored Cross-Site Scripting (XSS) vulnerability in the CSS & JavaScript Toolbox plugin for WordPress. The flaw affects all plugin versions up to and including 12.0.5. Authenticated attackers with administrator-level permissions can inject arbitrary JavaScript through the plugin's admin settings. The injected payload executes in the browser of any user who visits an affected page.
The issue stems from insufficient input sanitization and output escaping in admin-controlled settings [CWE-79]. Exploitation is limited to WordPress multi-site installations or single-site installations where the unfiltered_html capability has been disabled for administrators.
Critical Impact
A compromised or malicious administrator on a WordPress multi-site network can pivot to script execution against Super Admins and site visitors, expanding the blast radius beyond a single tenant.
Affected Products
- CSS & JavaScript Toolbox WordPress plugin — all versions through 12.0.5
- WordPress multi-site installations running the affected plugin
- WordPress single-site installations where unfiltered_html has been disabled
Discovery Timeline
- 2025-11-01 - CVE-2025-11928 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11928
Vulnerability Analysis
The CSS & JavaScript Toolbox plugin exposes administrative settings that accept user-supplied content. The plugin fails to sanitize input on save and fails to escape output on render. Attackers with administrator privileges can store JavaScript payloads that execute when other users load the affected page.
The scope change reflected in the CVSS vector indicates the payload executes in a security context different from the vulnerable component. On multi-site networks, a site administrator on a subsite can target Super Admins or users on other sites within the network. The impact includes session theft, forced administrative actions, and delivery of secondary payloads.
Root Cause
The vulnerability arises because the plugin trusts administrator input to the settings interface and stores raw values without sanitization callbacks such as sanitize_text_field() or wp_kses(). On output, the stored values are printed without escape functions such as esc_html(), esc_attr(), or esc_js(). WordPress normally treats administrators as trusted through the unfiltered_html capability, but multi-site installations and hardened single-site environments revoke that capability, exposing the missing plugin-level controls.
Attack Vector
An authenticated attacker with administrator access on an affected WordPress installation navigates to the CSS & JavaScript Toolbox settings screen. The attacker submits a payload containing an HTML tag with an embedded script or event handler. The plugin persists the payload in the database. When a subsequent visitor loads a page that renders the affected setting, the browser parses the injected markup and executes the script under the origin of the WordPress site.
Exploitation is described in the Wordfence Vulnerability Report. The corresponding code change is documented in the WordPress Plugin Changeset.
Detection Methods for CVE-2025-11928
Indicators of Compromise
- Unexpected <script> tags, on* event handlers, or javascript: URIs stored in wp_options or plugin-specific tables associated with CSS & JavaScript Toolbox
- Administrator or Super Admin account changes to plugin settings that do not match a legitimate change window
- Browser console errors or Content Security Policy violations originating from pages that render plugin content
Detection Strategies
- Query the WordPress database for plugin-owned option rows and search stored values for <script, onerror=, onload=, and javascript: substrings
- Review the WordPress audit log for update_option events tied to the CSS & JavaScript Toolbox plugin and correlate to the acting administrator
- Compare the installed plugin version against 12.0.5 and flag any host still on an affected release
Monitoring Recommendations
- Alert on new or modified administrator accounts on multi-site networks, particularly those that immediately edit plugin settings
- Monitor outbound requests from browsers of authenticated WordPress users for beaconing patterns consistent with stolen session cookies
- Enable and forward WordPress and web server logs to a centralized analytics platform for retention and correlation across sites
How to Mitigate CVE-2025-11928
Immediate Actions Required
- Update the CSS & JavaScript Toolbox plugin to a version later than 12.0.5 once released by the maintainer
- Audit administrator and Super Admin accounts on multi-site networks and remove unused or unrecognized principals
- Inspect existing plugin settings for stored HTML or JavaScript payloads and remove any content that is not expected
Patch Information
At the time of the NVD entry, no fixed version above 12.0.5 was identified in the enriched data. Site operators should track the WordPress Plugin Changeset and the Wordfence Vulnerability Report for a confirmed patched release and apply it across all sites in the network.
Workarounds
- Deactivate the CSS & JavaScript Toolbox plugin on multi-site installations until a patched version is available
- Restrict administrator role assignment on multi-site networks to a minimal, vetted set of users
- Deploy a Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads
- Place the WordPress admin interface behind a web application firewall rule set that inspects admin-ajax.php and settings POST bodies for script markup
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
