Content Pilot Autoblogging Affiliate Marketing Suite
Monthly
Stored cross-site scripting in the Content Pilot - Autoblogging & Affiliate Marketing Suite plugin for WordPress (through 2.2.4) lets an unauthenticated remote party inject scripts into posts generated from a configured RSS campaign, provided the administrator has pointed that campaign at a feed whose article content the attacker can influence and the campaign author holds unfiltered_html (Administrator by default). The malicious value is taken from a remote article's meta description and persisted as post_content without wp_kses_post filtering, then executes when a user views the generated post. No public exploit was identified at time of analysis; the prerequisite of an admin-configured, attacker-influenceable RSS campaign is why the assessed vector carries AC:H despite PR:N, making this a conditional, moderate-severity issue.
Stored cross-site scripting in the Content Pilot - Autoblogging & Affiliate Marketing Suite plugin for WordPress (through 2.2.4) lets an unauthenticated remote party inject scripts into posts generated from a configured RSS campaign, provided the administrator has pointed that campaign at a feed whose article content the attacker can influence and the campaign author holds unfiltered_html (Administrator by default). The malicious value is taken from a remote article's meta description and persisted as post_content without wp_kses_post filtering, then executes when a user views the generated post. No public exploit was identified at time of analysis; the prerequisite of an admin-configured, attacker-influenceable RSS campaign is why the assessed vector carries AC:H despite PR:N, making this a conditional, moderate-severity issue.