Alex
Monthly
Stored Cross-Site Scripting in the Featured Video Plus WordPress plugin (versions ≤ 2.3.3) allows contributor-role users to inject persistent malicious scripts into featured video fields. When a higher-privileged user such as an editor or administrator views the affected post, the script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive data exposure in the Featured Video Plus WordPress plugin (versions <= 2.3.3) allows any remote attacker to retrieve sensitive information without credentials via a crafted network request. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable against any default installation of the plugin with no prerequisites beyond network access. Classified under CWE-201, the plugin inserts sensitive information into its sent data, making it passively harvestable. No public exploit code or CISA KEV listing has been identified at time of analysis.
The mintToken function of a smart contract implementation for ALEX, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored Cross-Site Scripting in the Featured Video Plus WordPress plugin (versions ≤ 2.3.3) allows contributor-role users to inject persistent malicious scripts into featured video fields. When a higher-privileged user such as an editor or administrator views the affected post, the script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive data exposure in the Featured Video Plus WordPress plugin (versions <= 2.3.3) allows any remote attacker to retrieve sensitive information without credentials via a crafted network request. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable against any default installation of the plugin with no prerequisites beyond network access. Classified under CWE-201, the plugin inserts sensitive information into its sent data, making it passively harvestable. No public exploit code or CISA KEV listing has been identified at time of analysis.
The mintToken function of a smart contract implementation for ALEX, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.