Ansar Import One Click Starter Sites For Elementor Amp Themes
Monthly
Reflected cross-site scripting in the Ansar Import - One Click Starter Sites - for Elementor & Themes WordPress plugin (versions up to and including 2.1.2) lets an unauthenticated attacker inject arbitrary script that executes in a victim's browser session once the victim clicks a crafted link or visits a malicious page. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment) - no attacker authentication is required, but exploitation depends on convincing a user to interact, and impact is confined to the victim's browser rather than the server. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Patchstack is credited with the report.
Reflected cross-site scripting in the Ansar Import - One Click Starter Sites - for Elementor & Themes WordPress plugin (versions up to and including 2.1.2) lets an unauthenticated attacker inject arbitrary script that executes in a victim's browser session once the victim clicks a crafted link or visits a malicious page. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment) - no attacker authentication is required, but exploitation depends on convincing a user to interact, and impact is confined to the victim's browser rather than the server. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Patchstack is credited with the report.