The Text Styler WordPress plugin fails to sanitize and escape user‑supplied styling values that are placed inside a front‑end style block, and it does not verify that an editor is authorized to modify the target post. Because of this, any user with contributor level or higher can embed arbitrary JavaScript into the post’s style attributes. When a visitor renders the affected post, the injected script runs in the visitor’s browser. Attackers can hijack user sessions, steal credentials, deface the site, or execute further attacks requiring the victim’s browser.

Any WordPress installation using the Text Styler plugin version 1.1.1 or earlier is vulnerable. The vendor is listed as Unknown:Text Styler. All sites that have granted contributor or higher access privileges to users and that utilize the plugin are at risk; administrators watching the posts can also be affected.

The CVSS score of 6.8 indicates moderate to high severity for this stored XSS vulnerability. The vulnerability requires the attacker to have at least contributor‑level access to create or edit a post; without that privilege the attack cannot be carried out locally. Once an authorized user crafts the offending styling value, exploitation from the web is possible. The EPSS score is not available and the CVE is not in CISA’s KEV catalog, but the lack of proper sanitisation and access checks indicates a high likelihood of successful exploitation by any attacker who can acquire contributor permissions. The impact is significant because it can affect any user who views the content, including site administrators.