Breadcrumb Navxt
Monthly
Unauthenticated cross-site scripting in the Breadcrumb NavXT WordPress plugin (versions <= 7.5.1) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for visiting users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable, low-complexity exploitation with scope change into the victim's browser context. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated trigger and large install base elevate real-world risk.
Unauthenticated cross-site scripting in the Breadcrumb NavXT WordPress plugin (versions <= 7.5.1) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for visiting users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable, low-complexity exploitation with scope change into the victim's browser context. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated trigger and large install base elevate real-world risk.