CVE-2025-13533 wipeoutmedia CVE debrief

Who should care

Administrators and security teams responsible for WordPress installations with the CSS & JavaScript Toolbox plugin should assess exposure and prioritize remediation. They should also monitor for suspicious activity on the admin dashboard and restrict access to the admin dashboard to authorized personnel only. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring

Why it matters

Defenders should prioritize verifying the version of the CSS & JavaScript Toolbox plugin and ensuring that it is up to date, as well as monitoring for suspicious activity on the admin dashboard. This vulnerability requires verification from official sources, and its impact and remediation are limited by the availability of information.

• Authenticated attackers with Administrator-level access and above can inject arbitrary web scripts
• Scripts execute when a user accesses the CJT block edit screen in the admin dashboard
• Potential for lateral movement and exploitation of other vulnerabilities

Technical summary

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, and Advanced assignment data. The vulnerability requires verification from official sources, and its impact and remediation are limited by the availability of information. Authenticated attackers with Administrator-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses the CJT block edit screen in the admin dashboard.

Defensive priority

Defenders should prioritize verifying the version of the CSS & JavaScript Toolbox plugin and ensuring that it is up to date, as well as monitoring for suspicious activity on the admin dashboard.

Recommended defensive actions

• Verify the version of the CSS & JavaScript Toolbox plugin and ensure it is up to date
• Monitor for suspicious activity on the admin dashboard
• Restrict access to the admin dashboard to authorized personnel only
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, and Advanced assignment data. Defenders should verify the version of the CSS & JavaScript Toolbox plugin and ensure

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.