Brave Conversion Engine Pro
Monthly
Cross-site scripting in Brave Conversion Engine (PRO), a WordPress plugin by Amplebyte Pvt Limited, is exploitable by unauthenticated remote attackers against all versions through 0.8.6. The CVSS scope-change indicator (S:C) confirms that successful injection executes attacker-controlled JavaScript within a victim user's browser context - separate from the vulnerable server component - enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed via CISA KEV, and no EPSS score was included in available intelligence; however, the PR:N/AC:L attack profile means any internet-accessible WordPress installation running this plugin is trivially reachable.
Cross-site scripting in Brave Conversion Engine (PRO), a WordPress plugin by Amplebyte Pvt Limited, is exploitable by unauthenticated remote attackers against all versions through 0.8.6. The CVSS scope-change indicator (S:C) confirms that successful injection executes attacker-controlled JavaScript within a victim user's browser context - separate from the vulnerable server component - enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed via CISA KEV, and no EPSS score was included in available intelligence; however, the PR:N/AC:L attack profile means any internet-accessible WordPress installation running this plugin is trivially reachable.