The CSS & JavaScript Toolbox plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator-level permissions can inject arbitrary scripts via the plugin's admin settings. This vulnerability specifically impacts multi-site WordPress installations or installations where the unfiltered_html capability is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction. No official patch or remediation details have been provided in the available data.

An attacker with administrator privileges on affected WordPress installations can inject malicious scripts that execute when users access the injected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of the victim user. The vulnerability does not affect availability and requires high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled). No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or removing the CSS & JavaScript Toolbox plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates and apply official patches promptly once available.