WordPress Just TinyMCE Custom Styles plugin <= 1.2.1 - Vulnerabilidade de Cross Site Request Forgery (CSRF)

The CSRF vulnerability allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could lead to unauthorized modification of plugin settings, potentially impacting the functionality and appearance of the website. While the direct impact might seem limited, a compromised plugin could be leveraged as a stepping stone for further attacks, especially if the plugin interacts with sensitive data or other systems. The attacker could, for example, alter custom styles to inject malicious code or redirect users to phishing sites.

Websites using Just TinyMCE Custom Styles plugin, particularly those with user accounts and custom style configurations, are at risk. Shared hosting environments where plugin updates are managed centrally are also vulnerable until the plugin is updated.

• wordpress / composer / npm:

grep -r 'just-tinymce-styles/index.php' /var/www/html/

• wordpress / composer / npm:

wp plugin list | grep 'Just TinyMCE Custom Styles'

• wordpress / composer / npm:

wp plugin update --all

1. 2025-12-09Disclosure

   disclosure

1. Reservado2025-10-24
2. Publicada2025-12-09
3. Modificada2026-04-28
4. EPSS atualizado2026-03-23

The primary mitigation is to upgrade to a patched version of Just TinyMCE Custom Styles as soon as it becomes available. Until the patch is released, consider implementing strict input validation and output encoding within the plugin's code to reduce the attack surface. Additionally, employing a Content Security Policy (CSP) can help prevent the browser from executing malicious scripts injected via CSRF. Regularly review user permissions and restrict access to sensitive plugin settings.

Instalações ativas

2KNicho

Avaliação do plugin