Ambed
Monthly
Reflected cross-site scripting in the Ambed WordPress theme (all versions up to and including 1.0.0) allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser by delivering a crafted link that reflects unsanitized input through the theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attack is network-reachable, low complexity, and requires no privileges to send, but it cannot succeed without convincing a targeted user - typically a logged-in administrator or a site visitor - to click the crafted URL. Only sites actively running the Ambed theme at 1.0.0 or earlier are exposed, there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis, and because the vector is reflected rather than stored, the payload must be re-delivered for each victim.
Reflected cross-site scripting in the Ambed WordPress theme (all versions up to and including 1.0.0) allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser by delivering a crafted link that reflects unsanitized input through the theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attack is network-reachable, low complexity, and requires no privileges to send, but it cannot succeed without convincing a targeted user - typically a logged-in administrator or a site visitor - to click the crafted URL. Only sites actively running the Ambed theme at 1.0.0 or earlier are exposed, there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis, and because the vector is reflected rather than stored, the payload must be re-delivered for each victim.