# Toggle Content <= 1.3.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes

- **ID:** WPSEC-2026-3038
- **Plugin:** Toggle Content (`toggle-content`), https://wordpress.org/plugins/toggle-content/
- **Affected versions:** from 1.2.2 before 1.3.2
- **Fixed in:** 1.3.2 (Update to 1.3.2 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Not seen, affected versions None seen (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/toggle-content
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3038/

## Description

The Toggle Content plugin for WordPress is vulnerable to CSS Injection via block style attributes (blockMeta, commonStyles, customCss) in all versions up to, and including, 1.3.1, due to insufficient sanitization of block CSS saved by users without the unfiltered_html capability before it is written to the post's public stylesheet: CSS comments, non-hex character escapes in function names and unclosed url() constructs are not handled. This makes it possible for authenticated attackers with Contributor-level access and above to inject CSS into pages that loads resources from attacker-controlled hosts, which can be used to exfiltrate page data through attribute selectors or alter page content for visitors.

## References

- https://wpsec.com/vuln/WPSEC-2026-3038/
- https://plugins.svn.wordpress.org/toggle-content/tags/1.3.2/
- https://wordpress.org/plugins/toggle-content/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3038/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.