Scripts n Styles

Scripts n Styles has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Scripts n Styles has a vendor fix available, so running the current release closes it.

All of these findings were reported by konagash. Scripts n Styles is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.2.11.

Strategic Overview

Avg CVSSMedium
4.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Scripts n Styles vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.4CVE-2023-31236

Scripts n Styles <= 3.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Scripts n Styles banner
Latestv3.5.8

Scripts n Styles

WraithKenny

Author

WraithKenny

4.4(30)
88/100
Last Updated
2023-06-06 (3y ago)
Active Installs
30,000+
Downloads
383,157
Requires WP
5.0+
Requires PHP
7.4+
Tested up to
WP 6.2.11
Created
2010-09-04 (16y ago)

This plugin allows Admin users the ability to add custom CSS and JavaScript directly into individual Post, Pages or any other registered custom post types. You can also add classes to the body tag and the post container. There is a Global settings page for which you can write Scripts n Styles for the entire blog. Admin’s can also add classes to the TinyMCE “Formats” dropdown which users can use to style posts and pages directly. As of Scripts n Styles 3+ styles are reflected in the post editor. Because only well trusted users should ever be allowed to insert JavaScript directly into the pages of your site, this plugin restricts usage to admin type users. Admin’s have access to even more sensitive areas by definition, so that should be relatively safe 😉 Notes about the implementation: Admin users, or more specifically, any user with the manage_options and unfiltered_html capabilities (which by default is only the admin type user) can use this plugin’s functionality. Some plugins extend user rolls, and so this plugin would naturally extend include rolls that have the appropriate capability. CSS Styles are embeded, not linked, at the bottom of the head element with style tags by using wp-head. If your theme doesn’t have this hook, this plugin (as well as most others) won’t work. JavaScript is embeded, not linked, at the bottom of the body (or head) element with script tags by using wp-footer (or wp-head). If your theme doesn’t have this hook, this plugin (as well as most others) won’t work. There is no input validation. This plugin puts exactly what you type in the meta box directly into the html with no error checking. You are an Admin, and we trust you to be carefull. Try not to break anything. Do to the licensing of the libraries used, this plugin is released “GPL 3.0 or later” if you care about those things.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C