Automatic Css
Monthly
Stored cross-site scripting in the Automatic.css WordPress plugin 4.0.0 lets an attacker write an unsanitized REQUEST_URI into the plugin's Activity Log, which is then rendered without escaping on the Activity Log settings page, executing arbitrary script in the browser of any administrator who opens that page. The flaw is confined to a single plugin version and only fires when the Activity Log feature is enabled and an admin actually reviews the log, so reliability and timing are attacker-controlled constraints; the vendor-assigned CVSS 3.1 base score is 6.4. No public exploit code was identified at time of analysis and there is no CISA KEV entry, and the analyst-assessed vector (PR:N/UI:R) differs from the supplied vector (PR:L/UI:N), so the exact authentication prerequisite for the injection step remains disputed in the available data.
Stored cross-site scripting in the Automatic.css WordPress plugin 4.0.0 lets an attacker write an unsanitized REQUEST_URI into the plugin's Activity Log, which is then rendered without escaping on the Activity Log settings page, executing arbitrary script in the browser of any administrator who opens that page. The flaw is confined to a single plugin version and only fires when the Activity Log feature is enabled and an admin actually reviews the log, so reliability and timing are attacker-controlled constraints; the vendor-assigned CVSS 3.1 base score is 6.4. No public exploit code was identified at time of analysis and there is no CISA KEV entry, and the analyst-assessed vector (PR:N/UI:R) differs from the supplied vector (PR:L/UI:N), so the exact authentication prerequisite for the injection step remains disputed in the available data.