Cool Formkit Lite
Monthly
Cross-site scripting in the Cool Formkit Lite WordPress plugin (all versions up to and including 2.7.8) allows a user holding a Contributor-level account to supply content that executes as script in the browser of a higher-privileged user who renders it, enabling theft of session data or other scripted actions in the victim's authenticated context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, 6.5) requires both an existing low-privileged account on the target site and victim interaction, so this is a moderate, not high-priority, issue that does not affect sites where Contributor accounts cannot be obtained or where privileged users never view attacker-controlled input. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the impact is bounded to low confidentiality, integrity and availability effects scoped to the vulnerable component.
Cross-site scripting in the Cool Formkit Lite WordPress plugin (all versions up to and including 2.7.8) allows a user holding a Contributor-level account to supply content that executes as script in the browser of a higher-privileged user who renders it, enabling theft of session data or other scripted actions in the victim's authenticated context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, 6.5) requires both an existing low-privileged account on the target site and victim interaction, so this is a moderate, not high-priority, issue that does not affect sites where Contributor accounts cannot be obtained or where privileged users never view attacker-controlled input. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the impact is bounded to low confidentiality, integrity and availability effects scoped to the vulnerable component.