CSS & JavaScript Toolbox
CSS & JavaScript Toolbox has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2025; all 4 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (50%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, PHP Remote File Inclusion.
Every one of the 4 issues recorded for CSS & JavaScript Toolbox has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. CSS & JavaScript Toolbox is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-3703CSS & JavaScript Toolbox < 12.0.3 - Authenticated (Subscriber+) Local File Inclusion
Read the full analysisVulnerability Records
CSS & JavaScript Toolbox
Author
wipeoutmedia
Safely add CSS, JavaScript, PHP or HTML to unique code blocks, then choose where it goes on your site. IDEAL FOR: Making CSS front-end changes – No need to modify theme files or work with tedious built-in theme options. Just create a CSS code block. Adding site functionality – Stop adding plugins for simple tasks as they can slow down your site. Create a JavaScript or PHP code block instead. Adding widgets, code snippets and third-party scripts – Code blocks are perfect for adding scripts such as Google Analytics and chat widgets to your website. CJT is built on the concept of a code block. Each code block is more than just a code editor. It also contains a location editor so you can click the sections of your website you want your code to run. It was designed for super-fast development without any cumbersome page refreshing. Create as many code blocks as you need and see all of your code and locations in the one dashboard. Don’t worry, CJT has been optimised to handle 100’s of code blocks and thousands of locations (i.e. Pages, Posts, Categories, Custom Posts, etc). Click for CSS & JavaScript Toolbox PLUS FEATURES: Easy to use ‘code blocks’ interface Powerful code editor Intuitive assignment panel (click where your code goes) Code/script library management Add code to the header or footer hook PREMIUM Add code to entire website, all posts, etc PREMIUM Add code via shortcodes, widgets, Gutenburg blocks, etc PREMIUM Add code via tags, URLs, regular expressions PREMIUM 8 additional hooks for more precise assignments PREMIUM Invert feature (run code everywhere but …) PREMIUM Editor tools (code auto complete, beautify/minify, etc) PREMIUM Code revisions system PREMIUM Backup and export/import system Click for CSS & JavaScript Toolbox PLUS OVERVIEW VIDEO
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C