Aftership Tracking
Monthly
Cross-site scripting in the AfterShip Tracking WordPress plugin (versions ≤ 1.18.1) enables subscriber-level authenticated users to inject malicious scripts that execute in the browsers of other site visitors or administrators. The CVSS scope change (S:C) confirms the injected payload executes outside the attacker's own session context, making administrator session hijacking the primary impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Cross-site scripting in the AfterShip Tracking WordPress plugin (versions ≤ 1.18.1) enables subscriber-level authenticated users to inject malicious scripts that execute in the browsers of other site visitors or administrators. The CVSS scope change (S:C) confirms the injected payload executes outside the attacker's own session context, making administrator session hijacking the primary impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.