Convert Pro
Monthly
Unauthenticated reflected Cross-Site Scripting (XSS) in the Convert Pro WordPress plugin (versions up to and including 1.0.1) allows remote, unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation with no authentication required, though victim interaction is needed. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature and WordPress ecosystem prevalence elevate practical risk.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Convert Pro WordPress plugin (versions up to and including 1.0.1) allows remote, unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation with no authentication required, though victim interaction is needed. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature and WordPress ecosystem prevalence elevate practical risk.