Mutation XSS in Go's golang.org/x/net/html package allows attackers to bypass HTML sanitization by exploiting a discrepancy between how the html.Parse() function constructs an internal tree and how html.Render() serializes it back. Applications that rely on this package to sanitize untrusted HTML before display are vulnerable: maliciously crafted input can survive sanitization and execute JavaScript in victims' browsers when the rendered output is viewed. No public exploit exists at time of analysis, though the Go security team has issued a fix in version 0.55.0.
Reflected Cross-Site Scripting in the CBX 5 Star Rating & Review WordPress plugin (versions up to and including 1.0.7) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'page' parameter rendered in administrative log templates. Successful exploitation requires social engineering an authenticated administrator into clicking a crafted URL, limiting automated mass exploitation while remaining a realistic threat in targeted phishing campaigns against WordPress site owners. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected Cross-Site Scripting in WP Blockade - Visual Page Builder (all versions through 0.9.14) allows authenticated attackers holding at minimum a WordPress Subscriber-level account to inject arbitrary JavaScript into pages rendered in a victim's browser. The vulnerability exists in the render_shortcode_preview() function, which passes raw GET input through do_shortcode() without sanitization or output escaping - when the input is not a recognized shortcode, WordPress returns it verbatim, causing any embedded script to execute. Exploitation requires social engineering an authenticated user (e.g., an admin) into clicking a crafted link, but the low barrier to entry (Subscriber-level account) significantly widens the attacker pool on multi-user WordPress installations. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Port 9100 thread exhaustion in HP ENVY 5000 series printers (firmware VERBASPP1N003.2237A.00) enables an unauthenticated attacker on the same network segment to permanently render the device unresponsive by holding TCP connections open with keep-alive packets. The firmware's complete absence of connection timeouts and concurrent session limits means all JetDirect session threads become permanently locked, requiring physical power cycling to recover - and the attack is trivially re-launched immediately after restart. No public exploit code has been identified and SSVC assigns exploitation as none, but a public researcher write-up exists on Medium, and the persistent, unrecoverable nature of the DoS makes real-world impact disproportionate to the moderate CVSS score.
Weak password encoding in STER (all versions before 9.5) exposes stored credentials to local reverse-engineering by any low-privileged user on the system. The root cause (CWE-261) is use of a reversible or insufficiently one-way encoding scheme rather than a cryptographically strong hashing algorithm, enabling an attacker who can observe encoded password data to deduce plaintext values by analyzing patterns across known-value samples. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the high confidentiality impact (VC:H in CVSS 4.0) confirms that successful exploitation fully exposes affected credentials. The issue was reported by CERT-PL and fixed by CIOP-PIB in version 9.5.
Heap buffer over-read in ImageMagick's distributed pixel cache server affects all Magick.NET NuGet package variants prior to version 14.12.0. An attacker with the ability to connect to a running `magick -distribute-cache` service can trigger an out-of-bounds read (CWE-125) in the server process, resulting in high-severity confidentiality impact (memory disclosure) and availability impact (potential crash). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.7 reflects meaningful mitigating constraints: high attack complexity and high privileges required per the vector.
Dell PowerFlex Manager versions 4.6.2 and earlier improperly store sensitive information in a manner accessible to low-privileged local users, resulting in unauthorized disclosure of confidential data with high confidentiality impact per CVSS. Affected deployments span both the Appliance and Rack form factors of the platform. No public exploit code has been identified at time of analysis and CISA KEV does not list this vulnerability, though the CWE-922 root cause and the 'Authentication Bypass' tag suggest the exposed data may include credentials or tokens that could enable downstream privilege escalation or lateral movement.
Insecure storage of sensitive information in Dell PowerFlex Manager versions up to and including 4.6.2 exposes credentials, keys, or configuration secrets to any attacker with local OS-level access to the appliance - no PowerFlex Manager authentication required. The CVSS vector (AV:L/AC:L/PR:N/UI:N) confirms the attacker needs only local system access, not application credentials, to retrieve the improperly protected data. No public exploit identified at time of analysis and no CISA KEV listing; however, the 'Authentication Bypass' tag in the intelligence data suggests the exposed sensitive material may itself enable downstream privilege escalation or authentication bypass against PowerFlex or its managed infrastructure.
Broken or risky cryptographic algorithm use in Dell PowerFlex Manager's SSH component (versions ≤4.6.2) allows a locally authenticated low-privileged attacker to bypass SSH protection mechanisms, affecting both Appliance and Rack form factors. The CVSS vector (AV:L/AC:H/PR:L) reflects significant exploitation barriers: physical or logical local access is required, attack complexity is high, and impact is limited to partial confidentiality and integrity loss with no availability impact. Dell has published dual advisories (DSA-2025-434 for Appliance, DSA-2025-435 for Rack); no public exploit or CISA KEV listing exists at time of analysis.
Stored XSS in Typebot's JavaScript viewer embed (packages/embeds/js) allows any authenticated bot author - including free-tier users - to inject arbitrary JavaScript into a visitor's browser by setting a rich text bubble link URL to a javascript: URI. When a visitor clicks the malicious link within an embedded bot, the payload executes in the host page's origin (S:C scope change), enabling exfiltration of cookies and session tokens from the embedding third-party site. No public exploit code or active exploitation is confirmed at time of analysis; a vendor-released patch is available in v3.16.0.
Broken access control in TeamViewer DEX Platform (On-Premises) before version 9.2 allows authenticated low-privileged users to invoke administrative API endpoints and access sensitive resources outside their authorized scope. The root cause is CWE-862 (Missing Authorization) - backend API endpoints omit proper role-based authorization checks despite confirming user identity. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the network-accessible attack vector and low complexity make exploitation straightforward for any user holding valid platform credentials.
OAuth scope validation bypass in Mattermost's GitHub integration allows authenticated users to escalate repository access beyond what was originally authorized. By manipulating the scope parameter in the GitHub OAuth authorization URL before the callback is processed, a low-privileged Mattermost user can obtain a GitHub token with broader permissions - including access to private repositories - than the application intended to grant. Affecting versions across four active release branches (10.11.x through 11.6.x), this is no public exploit identified at time of analysis and is not listed in CISA KEV, but the low complexity and authentication-only barrier make it a realistic insider or compromised-account risk.
Authorization bypass in Devolutions Server's entry status management feature allows authenticated non-administrator users to circumvent an administrator-enforced Pending Approval workflow, gaining unauthorized access to protected entry data through a crafted status change request. Affected versions span the entire 2025.3.x line through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 to 2026.1.16.0, as confirmed by Devolutions advisory DEVO-2026-0013. No public exploit has been identified and EPSS sits at 0.03% (7th percentile), indicating negligible observed exploitation activity; SSVC corroborates no known exploitation at time of analysis.
Authorization bypass in MotoPress Hotel Booking plugin for WordPress (all versions through 6.0.1) allows unauthenticated remote attackers to overwrite or delete internal booking notes for any reservation by supplying an arbitrary booking ID. The root cause is a nonce that is unconditionally output into every public page's HTML via wp_localize_script under MPHB._data.nonces, meaning any site visitor - without an account or any prior interaction - can obtain a valid nonce and invoke the update-booking-notes AJAX action against any booking. No public exploit code has been identified at time of analysis, but the trivially accessible nonce makes this effectively zero-friction to abuse.
Server crash via race condition in Mattermost's persistent notification and channel archival subsystem allows any low-privileged authenticated user to bring down the server with no user interaction required. Affected branches span 10.11.x through 11.6.x across multiple maintenance lines. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the low authentication bar combined with network accessibility and low attack complexity makes this a credible insider threat or targeted denial-of-service vector against any exposed Mattermost deployment.
Session freshness bypass in Flask-Security-Too 5.8.0 allows an attacker who controls a stale authenticated victim session to satisfy the victim session's reauthentication requirement using their own OAuth identity, not the victim's. The flaw in `oauth_glue.py` causes `oauth_verify_response()` to update `session["fs_paa"]` (the freshness timestamp) without verifying that the OAuth-resolved user matches the currently authenticated session user. Exploitation was confirmed via a detailed proof-of-concept that successfully changed a victim user's username through the built-in `/change-username` route after bypassing the freshness gate. Publicly available exploit code exists; no CISA KEV listing at time of analysis.
XML External Entity injection in Apache CXF's WS-Transfer module exposes SOAP endpoints to server-side file read and internal network probing by unauthenticated remote attackers. The insecure XML parser configuration (CWE-611) affects all 3.x releases before 3.6.11, 4.0.x-4.1.x before 4.1.6, and 4.2.0 before 4.2.1. No public exploit has been identified at time of analysis, EPSS sits at the 8th percentile (0.03%), and CISA SSVC rates exploitation as 'none', placing this squarely in the patch-on-schedule rather than emergency-response category despite the broad network attack vector.
Panic-induced denial of service in the golang.org/x/crypto/ssh/agent package allows remote unauthenticated attackers to crash processes by submitting specially crafted SSH agent protocol messages containing malformed wire-format bytes that are unsafely cast into an ed25519.PrivateKey without sufficient validation. All versions of golang.org/x/crypto/ssh/agent prior to 0.52.0 are affected. No public exploit exists at time of analysis (EPSS 0.02%), though the SSVC framework flags the attack as automatable, and a vendor patch is available.
Heap-buffer-overflow in libheif 1.21.2 and prior exposes any application parsing untrusted HEIF sequence files to an out-of-bounds read during file ingestion, with potential for heap memory disclosure or process crash. The flaw is triggered the moment a victim opens a crafted file - no additional interaction beyond file opening is required - making it a practical threat in desktop image viewers, browsers, and media pipelines that embed libheif. No public exploit has been identified at time of analysis, EPSS sits at 0.04% (11th percentile), and a vendor-released patch (v1.22.0) is available, keeping real-world exploitation risk currently assessed as low-moderate despite the memory-corruption class.
Default credential exposure in syslink software AG Avantra (all versions before 25.3.0) on Linux and Windows allows a local attacker with high-privilege access to authenticate using known default passwords, achieving high confidentiality impact against monitoring data and infrastructure configurations managed by the platform. Reported by NCSC.ch and addressed in version 25.3.0, this CWE-1393 flaw represents an insider threat or post-compromise lateral movement risk for organizations running Avantra in SAP and IT operations environments. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Open redirect in Devolutions Server's external authentication provider flow allows unauthenticated remote attackers to redirect victims to attacker-controlled domains by embedding a crafted redirect parameter in a login link. Affected versions span 2026.1.6.0-2026.1.16.0 and all 2025.3.x releases through 2025.3.20.0, covering a significant window of recent deployments. No public exploit code exists and CISA KEV confirms no active exploitation, though the privileged-access-management context elevates the phishing risk beyond what the raw CVSS 5.0 score suggests.
Heap buffer overflow in vifm's trie implementation exposes versions 0.12.1 through 0.14.3 to memory corruption or application crash when processing history entries that exceed PATH_MAX*2 bytes during state file (vifminfo.json) load and merge. The root cause is a missing runtime length check in release builds - a guard assert existed only in debug builds, leaving production binaries unprotected against oversized keys in the trie string storage. Exploitation yields at most application availability impact (crash); no public exploit code exists and CISA has not added this to the KEV catalog, with EPSS at 0.02%.
Spreadsheet formula injection in Best Practical Request Tracker (RT) allows a low-privileged authenticated attacker to embed malicious formulas in ticket fields that execute when an administrator or staff member exports data to CSV and opens the file in a spreadsheet application. Affected versions span the entire RT 5.0 line prior to 5.0.10 and RT 6.0.0 through 6.0.2. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the attack surface is broad given that CSV exports are a routine administrative workflow in ticketing systems.
Authenticated denial-of-service in Mattermost's plugin subsystem allows a low-privileged user to crash the plugin process by sending a crafted HTTP request to the PR details API endpoint. Affected across four active release branches (10.11.x, 11.4.x, 11.5.x, 11.6.x), the flaw stems from missing input validation in API request handlers (CWE-1287). No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the low authentication barrier (any valid account) combined with network accessibility makes it a realistic insider or post-compromise nuisance risk.
Sensitive information exposure in the Slider by Soliloquy WordPress plugin (versions ≤ 2.8.1) allows authenticated attackers with subscriber-level access to read draft slider content that should be restricted to administrators and editors. The flaw exists in the plugin's map_meta_cap implementation within posttype.php, where capability checks are insufficiently enforced, permitting low-privileged users to retrieve draft slider metadata including unpublished media URLs, captions, and full slider configuration details. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in the Vedrixa Forms WordPress plugin (all versions through 1.1.1) permits authenticated attackers with subscriber-level access to overwrite the structure of any registration form by writing attacker-controlled data directly to the plugin's FORMS database table. The root cause is a missing authorization check on the form-saving AJAX handler, compounded by the fact that the required ajax-nonce is publicly exposed via wp_localize_script() on any page rendering a form shortcode - meaning any authenticated visitor can harvest the nonce without elevated privileges. The vulnerability is not listed in CISA KEV and no public exploit has been identified at time of analysis; however, on open-registration WordPress sites the subscriber-level barrier is trivially bypassed.
Improper access control in Devolutions Server exposes documentation and attachments of sealed vault entries to any authenticated user who holds vault read access. Sealed entries are an explicit security boundary intended to restrict access beyond standard vault permissions - this bypass undermines that control entirely via a crafted API request. No public exploit has been identified and SSVC indicates no known exploitation, but the attack requires only low-privilege authentication, making it accessible to any insider or compromised credential with vault read rights.
Missing authorization on the profile update API in Devolutions Server allows any authenticated Active Directory user to modify their own profile attributes beyond their permitted scope via a crafted API request. Affected are versions 2025.3.20.0 and earlier and 2026.1.6.0 through 2026.1.16.0. No public exploit has been identified and EPSS sits at 0.03% (8th percentile), but any AD-authenticated user with network reach to the API can tamper with profile data without additional privilege.
Missing authorization in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to bypass vault creation controls via a crafted import request. The flaw targets the vault import API endpoint, enabling unauthorized vault provisioning within a Privileged Access Management platform - a sensitive context where vault-level control can have downstream impact on managed credentials. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.03% (8th percentile) reflects minimal current exploitation likelihood.
Devolutions Server's entry activity log feature fails to enforce per-permission authorization on its API layer, allowing authenticated users to retrieve audit trails for vault entries they can access but are explicitly denied log-viewing rights on. Affected are all Devolutions Server releases through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 through 2026.1.16.0. No public exploit code exists and EPSS sits at 0.03% (7th percentile), placing real-world exploitation risk firmly in the low tier despite the network-reachable attack vector.
Team member role data leaks from Mattermost's API across multiple actively maintained release branches due to missing sanitization of response payloads for low-privilege callers. Any authenticated user - regardless of their team role - can invoke standard team API endpoints and receive unsanitized member objects that expose role designations such as admin or system_admin. The vulnerability spans 10.11.x through 11.6.x, has no public exploit code, and is not listed in CISA KEV, but the low attack complexity and broad version coverage make it a meaningful reconnaissance risk in enterprise or multi-tenant deployments.
Cross-Site Request Forgery in the Widget Context WordPress plugin (all versions ≤ 1.3.3) allows unauthenticated attackers to modify widget visibility context settings stored in the WordPress options table by forging a POST request to /wp-admin/widgets.php. The root cause is missing or incorrect nonce validation in the save_widget_context_settings function, confirmed by Wordfence and corroborated by source code references at WidgetContext.php lines 91, 282, and 311. Exploitation requires social engineering a logged-in administrator into clicking an attacker-controlled link; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthorized modification of weather display settings in the Location Weather WordPress plugin (versions ≤3.0.2) is achievable by any authenticated user with Contributor-level access or above, due to missing capability checks on the administrative functions `splw_update_block_options()` and `lwp_clean_weather_transients()`. Affected sites expose the protective nonce to all authenticated sessions via `wp_localize_script()` on the `init` hook, neutralizing what would otherwise be a secondary CSRF defense and making exploitation straightforward for any logged-in user. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; real-world impact is limited to disruption of weather widget display and cache integrity rather than data theft or code execution.
Missing authorization controls in the FastX WordPress theme allow authenticated Subscriber-level users to install and activate the PostX plugin without administrative approval. The vulnerability exists in two AJAX callback functions - 'ultp_install_callback' and 'ultp_activate_callback' - which fail to verify whether the requesting user holds sufficient capabilities before executing privileged plugin management operations. All versions up to and including 1.0.2 are affected per WPXPO's theme codebase on themes.trac.wordpress.org. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery in the Alfie - Feed Plugin for WordPress (all versions ≤ 1.2.1) allows unauthenticated remote attackers to delete arbitrary plugin feed data by tricking a logged-in site administrator into clicking a crafted link. The missing nonce validation on the alfie_manage() function means any forged GET request containing the 'delete' parameter will be processed without verifying its origin, permanently removing records from the plugin's four database tables. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity and purely social-engineering prerequisite make it a credible threat against active WordPress sites using this plugin.
Information disclosure in Magick.NET's distributed pixel cache server exposes sensitive pixel data due to the absence of a challenge-response authentication model on the cache service. All Magick.NET NuGet packages (Q16, Q16-HDRI, and OpenMP variants across AnyCPU, x64, x86, arm64 architectures) prior to version 14.12.0 are affected. A highly privileged local attacker meeting the high-complexity conditions of this vulnerability could read pixel cache contents belonging to other processes, leaking potentially sensitive image data. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap buffer over-write in ImageMagick's distributed pixel cache server (`magick -distribute-cache`) allows an attacker who can connect to the service to corrupt the server process's heap memory, resulting in a high-severity denial-of-service condition. All Magick.NET NuGet package variants (Q16, HDRI, OpenMP, across arm64/x64/x86/AnyCPU architectures) prior to version 14.12.0 are confirmed affected. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA KEV; however, a notable discrepancy exists between the CVSS attack vector (AV:L, local) and the description's implication of service-level connectivity, which warrants independent verification before fully trusting the low CVSS score.
File descriptor hijacking in ImageMagick's distributed pixel cache server (magick -distribute-cache) exposes sensitive data via a race condition exploitable by a privileged local attacker. Affected are all Magick.NET NuGet packages across Q16, Q16-HDRI, OpenMP, and ARM64 variants prior to version 14.12.0. Successful exploitation yields high-confidentiality impact - an attacker can read file descriptors belonging to the server process - though no public exploit code exists and this is not currently listed in the CISA KEV catalog.
Integer overflow in NewNTUnicodeString within the Go extended syscall package for Windows allows a local low-privileged attacker to silently inject a truncated NTUnicodeString into applications that expect validation failures on oversized input. Affected is golang.org/x/sys/windows before version 0.44.0. Because the function returns a truncated result rather than an error, consuming code may proceed with a malformed string, potentially bypassing length-based security checks or causing downstream logic errors - no public exploit has been identified at time of analysis and EPSS exploitation probability is 0.02%.
Unverified password change in Devolutions Server allows a low-privileged authenticated attacker to reset any user's account password by submitting a crafted request that omits or bypasses the current-password verification step. Affected are all releases up to and including 2025.3.20.0 and a specific 2026.1.x branch window (2026.1.6.0 through 2026.1.16.0), meaning the flaw spans both legacy and recent deployments of this enterprise PAM platform. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile) and SSVC exploitation status is confirmed as none, but the sensitivity of a PAM system as the target elevates real-world risk beyond the raw CVSS 3.1 score of 3.1.
Cross-typebot result data leakage in Typebot versions 3.15.2 and prior allows an authenticated user to read session variables, prior answers, and PII from a different typebot by supplying a foreign resultId to the startChat endpoint. The bot engine's findResult query omits typebotId from its database filter (CWE-639 IDOR), so any valid result record is returned regardless of which typebot owns it. If the attacker possesses a valid CUID2 resultId from another typebot and that typebot has rememberUser enabled, they can read the original user's names, emails, phone numbers, and other session variables exposed through matching variable names. No public exploit has been identified at time of analysis; vendor-released patch is available in version 3.16.0.
Sealed-entry audit bypass in Devolutions Server allows an authenticated high-privileged user to silently retrieve sensitive data from protected vault entries without generating the expected unseal audit notification, undermining privileged access oversight controls. Affected versions span all releases through 2025.3.20.0 and the 2026.1.6.0 to 2026.1.16.0 range. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the compliance and insider-threat implications are significant in PAM environments where sealed-entry audit trails are the primary detection mechanism for sensitive credential access.
Cross-vault authorization bypass in Devolutions Server's entry duplication feature permits an authenticated low-privilege user to exfiltrate documentation and attachments from vaults they cannot access by submitting a crafted save request with a foreign entry identifier. Two distinct version ranges are affected: all releases at or before 2025.3.20.0 and the 2026.1.6.0-2026.1.16.0 branch. EPSS stands at 0.03% (7th percentile), SSVC confirms no known exploitation, and no public exploit code has been identified, making this a low-urgency but meaningful finding for organizations relying on strict vault segregation within their PAM environment.
Devolutions Server's entry export feature silently bypasses the unseal notification workflow when an authenticated, export-privileged user submits a crafted export request against a sealed entry. Sealed entries in Devolutions Server carry an explicit administrative oversight guarantee - unseal events trigger notifications to administrators - making this a control bypass against a core PAM audit promise rather than a direct credential theft. Affected versions span 2025.3.20.0 and earlier as well as 2026.1.6.0 through 2026.1.16.0; no public exploit exists and EPSS sits at 0.03% (8th percentile), reflecting no observed attacker interest at time of analysis.
Cleartext TCP transmission in STER (by Poland's Central Institute for Labour Protection, CIOP) exposes sensitive data including passwords, personal data, and authentication tokens to interception. All versions prior to 9.5 are affected per EUVD-2026-31424. Exploitation requires the attacker to be pre-positioned on the network path (CVSS AT:P), limiting opportunistic mass exploitation, but poses meaningful risk in shared or corporate network environments where insider or adjacent-network threats exist. No public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Concrete CMS 9.5.0 and earlier exposes an IDOR combined with an incorrect authorization level check in the Express association Reorder dialog, enabling authenticated users with only view-only permission to tamper with entity ordering state for entries they do not own. The flaw is limited to sites actively using the Concrete CMS Express application-builder feature with entity ordering configured - a non-default deployment subset. No public exploit or active exploitation has been identified; all available signals (CVSS 4.0 of 2.3, EPSS at 0.04%, SSVC exploitation: none) consistently characterize this as a low-priority, narrow-impact finding.
CSRF in Concrete CMS 9.5.0 and below enables a network-based attacker to trick an authenticated backend editor into silently approving an unintended file version via the Backend\File::approveVersion endpoint, effectively downgrading a published file or activating an unpublished co-editor version without the victim's knowledge. Exploitation is constrained to users holding the edit_file_contents permission who can be socially engineered into visiting an attacker-controlled page while logged in. No public exploit code exists and no active exploitation has been identified; EPSS at 0.02% and SSVC Exploitation:none confirm minimal real-world urgency. Vendor patch available in version 9.5.1.
Stored XSS in Concrete CMS 9.0 through 9.5.0 enables a rogue editor to inject persistent JavaScript via the page name field within the Atomik theme, executing in the browser session of any authenticated user who visits the affected pages. Consequences include session hijacking, credential theft, and unauthorized actions performed as the victim - potentially escalating to higher privileges if an administrator is targeted. No active exploitation is confirmed (SSVC: none; EPSS 0.04% at the 13th percentile), and a vendor-released patch is available in version 9.5.1.