CVE-2025-13533 is a stored cross-site scripting vulnerability in the wipeoutmedia CSS & JavaScript Toolbox WordPress plugin affecting all versions up to 12.0.6. The vulnerability is due to improper neutralization of input during web page generation, specifically in the Assignment Engine fields (Expressions, URLs, Advanced assignment data). Authenticated attackers with Administrator privileges can inject arbitrary scripts that execute when users access the CJT block edit screen in the WordPress admin dashboard. The CVSS 3.1 base score is 4.4 (medium), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with Administrator-level access can inject malicious scripts into the plugin's assignment fields, leading to stored XSS. This can result in execution of arbitrary scripts in the context of the admin dashboard when users access the affected CJT block edit screen. The impact includes partial confidentiality and integrity loss but no availability impact. The vulnerability requires high privileges and has a high attack complexity, limiting exploitation scope to trusted administrators.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only and consider monitoring for suspicious activity related to the plugin's assignment fields. Avoid using the vulnerable plugin versions or disable the plugin if possible until remediation is provided.