WordPress Plugin Vulnerabilities

YellowPencil Visual CSS Style Editor <= 7.2.0 - Unauthenticated Arbitrary Options Updates

Description

The Visual CSS Style Editor WordPress plugin was affected by an Unauthenticated Arbitrary Options Updates security vulnerability.

Affects Plugins

Plugin icon
yellow-pencil-visual-theme-customizer
Fixed in 7.2.1

References

CVE
CVE-2019-11886
URL
https://www.wordfence.com/blog/2019/04/zero-day-vulnerability-in-yellow-pencil-visual-theme-customizer-exploited-in-the-wild/
URL
https://blog.nintechnet.com/zero-day-vulnerability-in-wordpress-visual-css-style-editor-plugin-actively-exploited/

Miscellaneous

Original Researcher
Unknown
Submitter
Ryan Dewhurst
Submitter website
https://wpscan.io
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
43c1db17-37f0-47b0-bb24-33ac9468c359

Timeline

Publicly Published
2019-04-11 (about 7 years ago)
Added
2019-04-12 (about 7 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2025-11-26
Title
SKT PayPal for WooCommerce < 1.5 - Unauthenticated Payment Bypass
Published
2015-12-14
Title
Admin Management Xtended <= 2.4.0 - Privilege Escalation
Published
2025-12-12
Title
Login Lockdown & Protection < 2.15 - IP Block Bypass
Published
2023-03-06
Title
Formidable Forms < 6.1 - IP Spoofing
Published
2020-05-07
Title
Ultimate Addons for Elementor < 1.24.2 - Registration Bypass