WordPress Just TinyMCE Custom Styles 插件 <= 1.2.1 - 跨站请求伪造 (CSRF) 漏洞

The CSRF vulnerability allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could lead to unauthorized modification of plugin settings, potentially impacting the functionality and appearance of the website. While the direct impact might seem limited, a compromised plugin could be leveraged as a stepping stone for further attacks, especially if the plugin interacts with sensitive data or other systems. The attacker could, for example, alter custom styles to inject malicious code or redirect users to phishing sites.

Websites using Just TinyMCE Custom Styles plugin, particularly those with user accounts and custom style configurations, are at risk. Shared hosting environments where plugin updates are managed centrally are also vulnerable until the plugin is updated.

• wordpress / composer / npm:

grep -r 'just-tinymce-styles/index.php' /var/www/html/

• wordpress / composer / npm:

wp plugin list | grep 'Just TinyMCE Custom Styles'

• wordpress / composer / npm:

wp plugin update --all

1. 2025-12-09Disclosure

   disclosure

1. 已保留2025-10-24
2. 发布日期2025-12-09
3. 修改日期2026-04-28
4. EPSS 更新日期2026-03-23

The primary mitigation is to upgrade to a patched version of Just TinyMCE Custom Styles as soon as it becomes available. Until the patch is released, consider implementing strict input validation and output encoding within the plugin's code to reduce the attack surface. Additionally, employing a Content Security Policy (CSP) can help prevent the browser from executing malicious scripts injected via CSRF. Regularly review user permissions and restrict access to sensitive plugin settings.

活跃安装数

2K小众

插件评分

4.8

需要WordPress版本

4.3+

兼容至

5.5.18