[ CVE-2026-115250 · Published 4 Nov 2026 ]
Vulnerability in Unknown Text Typing
CVSS 6.8
EPSS <1%No fix listed yet
[ Description ]Official description
The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.