{"id":"CVE-2026-115250","kind":"vulnerability","aliases":["CVE-2026-115250"],"related":[],"title":"WordPress Text Typing plugin: contributors can store scripts that run in visitors' browsers","description":"The Text Typing  WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page.","summary":"The Text Typing WordPress plugin before 2.2.2 does not sanitize a block attribute before storing it and rendering it in a page. A user with the Contributor role or higher can store script that runs in the browser of anyone who views the affected page.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","text-typing-plugin","wordpress"],"not_affected_if":["only-trusted-editors","plugin-2.2.2-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Text Typing plugin in the WordPress admin plugins list; versions before `2.2.2` are affected.\n- Confirm whether any users hold the Contributor role or above who should not be trusted to add content.","fix":"- Text Typing plugin: move to `2.2.2` or later.","status":"open","published_at":"2026-11-04T06:17:01+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","triaged_at":"2026-11-04T06:26:17+00:00","updated_at":"2026-11-04T06:26:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:17Z","model":"claude-haiku-5-5","output":{"fix":"- Text Typing plugin: move to `2.2.2` or later.","reach":"internet","title":"WordPress Text Typing plugin: contributors can store scripts that run in visitors' browsers","impact":"medium","summary":"The Text Typing WordPress plugin before 2.2.2 does not sanitize a block attribute before storing it and rendering it in a page. A user with the Contributor role or higher can store script that runs in the browser of anyone who views the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","text-typing-plugin","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Scripts run in visitors' browsers, stealing sessions or redirecting users","analyst_note":"","how_to_check":"- Check the installed version of the Text Typing plugin in the WordPress admin plugins list; versions before `2.2.2` are affected.\n- Confirm whether any users hold the Contributor role or above who should not be trusted to add content.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-2.2.2-or-later","only-trusted-editors"],"who_is_affected":"Sites running the Text Typing WordPress plugin before 2.2.2 where users with Contributor or higher roles can create or edit posts. Sites without this plugin, or where only fully trusted editors can write content, face less risk. Visitors to affected pages are the ones whose browsers run the injected script.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4137,"output_tokens":563,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115250':16A,19A '-2026':15A,18A '2.2.2':35B,80C 'affect':72B,136C 'allow':111C 'anyon':68B,133C 'attack':126C 'attribut':41B,89C 'block':40B,88C 'browser':13A,66B,131C 'client':108C 'client-sid':107C 'contributor':5A,55B,115C 'cross':123C 'cross-sit':122C 'cve':14A,17A 'element':100C 'escap':86C 'execut':128C 'higher':58B 'host':23B 'later':94C 'output':95C 'packag':20B 'page':50B,73B,99C,137C 'perform':120C 'plugin':4A,27B,33B,78C 'proper':83C 'read':103C 'render':46B,105C 'role':56B,116C 'run':10A,63B 'sanit':38B,84C 'script':8A,61B,110C,125C 'self':22B 'self-host':21B 'side':109C 'site':124C 'store':7A,43B,60B,91C,121C 'text':2A,25B,30B,75C 'text-typing-plugin':24B 'type':3A,26B,31B,76C 'user':52B,112C 'view':70B,134C 'visitor':12A 'wordpress':1A,28B,32B,77C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Text Typing WordPress plugin before 2.2.2 where users with Contributor or higher roles can create or edit posts. Sites without this plugin, or where only fully trusted editors can write content, face less risk. Visitors to affected pages are the ones whose browsers run the injected script.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","texttypingplugin","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115250","severity":null,"published_at":"2026-11-04T06:17:01+00:00","modified_at":"2026-11-04T06:17:01+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","fetched_at":"2026-11-04T06:25:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}