The CSS & JavaScript Toolbox plugin for WordPress contains a flaw in the cjtoolbox shortcode. User supplied attributes are neither properly sanitized nor escaped, allowing an authenticated user with contributor or higher privileges to store malicious JavaScript on a page. When visitors view the page containing the shortcode, the injected script is executed in their browsers, creating a stored cross‑site scripting vulnerability. The flaw is classified as CWE‑79.

WordPress sites that have the CSS & JavaScript Toolbox plugin from wipeoutmedia, any release up to and including version 12.0.6. The vulnerability does not affect other plugins or products. It requires that the site be running WordPress with the mentioned plugin.

The CVSS base score of 6.4 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation is unknown, and the vulnerability is not tracked in CISA's KEV catalog. An attacker must be authenticated with contributor or higher access to inject code, after which the stored script will run on every user who views the affected page. While the need for elevated credentials lowers the risk compared to a public‑exposed XSS, the impact remains significant for sites that permit contributors to edit content.