CVE-2026-115250 · Package
NO FIX YET · SEE WHAT TO DO
The Text Typing WordPress plugin before 2.2.2 does not sanitize a block attribute before storing it and rendering it in a page. A user with the Contributor role or higher can store script that runs in the browser of anyone who views the affected page.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Text Typing WordPress plugin before 2.2.2 where users with Contributor or higher roles can create or edit posts. Sites without this plugin, or where only fully trusted editors can write content, face less risk. Visitors to affected pages are the ones whose browsers run the injected script.
Not affected if only-trusted-editors, plugin-2.2.2-or-later, plugin-not-installed
Who cares self-hosted, text-typing-plugin, wordpress
2.2.2 are affected.2.2.2 or later.The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.