CVE-2026-88788 is a stored cross-site scripting vulnerability in the Text Styler WordPress plugin through version 1.1.1. The plugin does not sanitize or escape user-supplied styling values before rendering them in front-end style blocks. Furthermore, it lacks proper permission checks to confirm that a user is authorized to edit the target post. This combination allows users with contributor-level access or above to inject malicious JavaScript code that executes in the browsers of anyone viewing the affected post, including site administrators.

An attacker with contributor-level access or higher can inject arbitrary JavaScript into posts, which executes in the browsers of users viewing those posts. This can lead to session hijacking, privilege escalation, or other malicious actions performed in the context of the victim's browser. The vulnerability affects site integrity and user trust, especially since administrators can be targeted.

No official patch or fix is currently documented. Users should restrict contributor-level access carefully and consider removing or disabling the Text Styler plugin until a fix is available. Monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Avoid granting contributor or higher privileges to untrusted users.