Toggle Content <= 1.3.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes
- ID
- WPSEC-2026-3038
- Plugin
- Toggle Content (toggle-content)
- Affected
- from 1.2.2 before 1.3.2
- Remediation
- Update to 1.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Not seen · Affected versions None seen among sites WPSec scans, 2026-11-13
- Attack surface
- Toggle Content on WPSec AttackSurface
- Fix released
- Published
Description
The Toggle Content plugin for WordPress is vulnerable to CSS Injection via block style attributes (blockMeta, commonStyles, customCss) in all versions up to, and including, 1.3.1, due to insufficient sanitization of block CSS saved by users without the unfiltered_html capability before it is written to the post's public stylesheet: CSS comments, non-hex character escapes in function names and unclosed url() constructs are not handled. This makes it possible for authenticated attackers with Contributor-level access and above to inject CSS into pages that loads resources from attacker-controlled hosts, which can be used to exfiltrate page data through attribute selectors or alter page content for visitors.
References
- https://wpsec.com/vuln/WPSEC-2026-3038/
- https://plugins.svn.wordpress.org/toggle-content/tags/1.3.2/
- https://wordpress.org/plugins/toggle-content/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS