CVE-2019-11886

HIGH 8.8CVE-2019-11886 · Published 13/05/2019 · updated 17/06/2026

In short

CVE-2019-11886 is a HIGH (CVSS 8.8) vulnerability affecting visual css style editor (yellowpencil).
Chance of exploitation in the next 30 days (EPSS): 2.3%, higher than 83.2% of all vulnerabilities.
Fix: update to 7.2.1 or later.

Package	Affected versions	Patched versions
visual css style editor yellowpencil	`< 7.2.1`	`7.2.1`

Description

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.

References

wordpress.org/plugins/yellow-pencil-visual-theme-customizer · Release Notes
wpvulndb.com/vulnerabilities/9256
pluginvulnerabilities.com/2019/04/09/recently-closed-visual-css-style-editor-wordpress-plugin-contains-privilege-escalation-vulnerability-that-leads-to-option-update-vulnerability
wordfence.com/blog/2019/04/zero-day-vulnerability-in-yellow-pencil-visual-theme-customizer-exploited-in-the-wild · Exploit

More vulnerabilities in visual css style editor

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free