Do Lasso
Monthly
Unauthenticated XSS in the Do Lasso WordPress plugin (versions <= 358) allows remote attackers to inject malicious scripts that execute in the browsers of visiting users, including site administrators, upon interaction with a crafted link or page. The scope change in the CVSS vector (S:C) indicates the injected script can escape the plugin's immediate context and affect the broader WordPress environment, including the admin panel. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in the Do Lasso WordPress plugin (versions <= 358) allows authenticated subscribers to traverse the server file system beyond the intended directory scope, achieving high confidentiality, integrity, and availability impact. The vulnerability is exploitable by any authenticated WordPress user holding the subscriber role - the lowest privilege tier - over the network, making it accessible to any registered site user. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the Patchstack advisory signals a patched version is available.
SQL injection in the Do Lasso WordPress plugin (versions ≤ 358) allows authenticated subscribers to execute arbitrary database queries against the underlying MySQL instance. The vulnerability carries a CVSS 8.5 score with a changed scope indicator, meaning successful exploitation can expose data beyond the plugin's own tables - potentially the entire WordPress database including user credentials and site configuration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar of subscriber-level access makes this reachable by any registered WordPress user on an affected site.
Unauthenticated IDOR in the Do Lasso WordPress affiliate link management plugin (versions 358 and earlier) allows remote attackers without any credentials to reference and manipulate internal objects by supplying attacker-controlled identifier values, resulting in unauthorized modification or disruption of affiliate link data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default plugin installations. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-privilege requirement lower the barrier to opportunistic abuse.
Unauthenticated XSS in the Do Lasso WordPress plugin (versions <= 358) allows remote attackers to inject malicious scripts that execute in the browsers of visiting users, including site administrators, upon interaction with a crafted link or page. The scope change in the CVSS vector (S:C) indicates the injected script can escape the plugin's immediate context and affect the broader WordPress environment, including the admin panel. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in the Do Lasso WordPress plugin (versions <= 358) allows authenticated subscribers to traverse the server file system beyond the intended directory scope, achieving high confidentiality, integrity, and availability impact. The vulnerability is exploitable by any authenticated WordPress user holding the subscriber role - the lowest privilege tier - over the network, making it accessible to any registered site user. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the Patchstack advisory signals a patched version is available.
SQL injection in the Do Lasso WordPress plugin (versions ≤ 358) allows authenticated subscribers to execute arbitrary database queries against the underlying MySQL instance. The vulnerability carries a CVSS 8.5 score with a changed scope indicator, meaning successful exploitation can expose data beyond the plugin's own tables - potentially the entire WordPress database including user credentials and site configuration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar of subscriber-level access makes this reachable by any registered WordPress user on an affected site.
Unauthenticated IDOR in the Do Lasso WordPress affiliate link management plugin (versions 358 and earlier) allows remote attackers without any credentials to reference and manipulate internal objects by supplying attacker-controlled identifier values, resulting in unauthorized modification or disruption of affiliate link data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default plugin installations. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-privilege requirement lower the barrier to opportunistic abuse.