Cozystay
Monthly
Unauthenticated Cross-Site Scripting in the CozyStay WordPress theme (versions 1.10.0 and earlier) by Loftocean allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims, crossing the security boundary into the victim's browser (S:C per CVSS vector). Exploitation requires social engineering a target into visiting a crafted URL, making phishing a prerequisite step. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the CozyStay WordPress theme (versions 1.10.0 and earlier) by Loftocean allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims, crossing the security boundary into the victim's browser (S:C per CVSS vector). Exploitation requires social engineering a target into visiting a crafted URL, making phishing a prerequisite step. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.