Scripts n Styles

Scripts n Styles has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 1 is fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 4.8, and the most serious one scores 5.3 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

2 independent researchers contributed these findings, one record each. Scripts n Styles is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.2.14.

Strategic Overview

Avg CVSSMedium
4.8/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all Scripts n Styles vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-62042

Scripts n Styles <= 3.5.8 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records
Scripts n Styles banner
Latestv3.5.8

Scripts n Styles

WraithKenny

Author

WraithKenny

4.4(30)
88/100
Last Updated
2023-06-06 (3y ago)
Active Installs
30,000+
Downloads
385,156
Requires WP
5.0+
Requires PHP
7.4+
Tested up to
WP 6.2.14
Created
2010-09-04 (16y ago)

This plugin allows Admin users the ability to add custom CSS and JavaScript directly into individual Post, Pages or any other registered custom post types. You can also add classes to the body tag and the post container. There is a Global settings page for which you can write Scripts n Styles for the entire blog. Admin’s can also add classes to the TinyMCE “Formats” dropdown which users can use to style posts and pages directly. As of Scripts n Styles 3+ styles are reflected in the post editor. Because only well trusted users should ever be allowed to insert JavaScript directly into the pages of your site, this plugin restricts usage to admin type users. Admin’s have access to even more sensitive areas by definition, so that should be relatively safe 😉 Notes about the implementation: Admin users, or more specifically, any user with the manage_options and unfiltered_html capabilities (which by default is only the admin type user) can use this plugin’s functionality. Some plugins extend user rolls, and so this plugin would naturally extend include rolls that have the appropriate capability. CSS Styles are embeded, not linked, at the bottom of the head element with style tags by using wp-head. If your theme doesn’t have this hook, this plugin (as well as most others) won’t work. JavaScript is embeded, not linked, at the bottom of the body (or head) element with script tags by using wp-footer (or wp-head). If your theme doesn’t have this hook, this plugin (as well as most others) won’t work. There is no input validation. This plugin puts exactly what you type in the meta box directly into the html with no error checking. You are an Admin, and we trust you to be carefull. Try not to break anything. Do to the licensing of the libraries used, this plugin is released “GPL 3.0 or later” if you care about those things.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C