Content Mask
Monthly
Stored Cross-Site Scripting in the Content Mask WordPress plugin before 1.8.5.6 allows any user holding at least a Contributor-level WordPress account to inject persistent malicious scripts into post content, which then execute in the browsers of all users - including administrators - who view or preview the affected page. Notably, the plugin's own built-in role-restriction feature fails to block the attack, widening the exploitation surface beyond what site operators may expect. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.16% (6th percentile) and SSVC 'exploitation: none' indicate no observed mass exploitation at time of analysis.
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored Cross-Site Scripting in the Content Mask WordPress plugin before 1.8.5.6 allows any user holding at least a Contributor-level WordPress account to inject persistent malicious scripts into post content, which then execute in the browsers of all users - including administrators - who view or preview the affected page. Notably, the plugin's own built-in role-restriction feature fails to block the attack, widening the exploitation surface beyond what site operators may expect. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.16% (6th percentile) and SSVC 'exploitation: none' indicate no observed mass exploitation at time of analysis.
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.