Dxp Toolkit
Monthly
Unauthenticated SQL injection in the Crowd Favorite DXP ToolKit WordPress plugin through version 2.0.1 allows remote attackers to read data from the underlying database, with the supplied assessment rating confidentiality impact as high and integrity and availability impact as none. The vulnerable endpoint or injectable parameter is not described in the available sources, and no public exploit code is identified at time of analysis. The vuln.today decision label is act_now, so remediation should be prioritized.
Stored cross-site scripting in the Crowd Favorite DXP ToolKit WordPress plugin, affecting versions from an unspecified starting point through 2.0.1, lets an attacker persist script content that executes in the browser of any user who later views the page rendering it. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) indicates network reachability and no privileges required, but a victim must load the affected page for the payload to fire, and the scope change reflects impact escaping the vulnerable component into the surrounding WordPress site. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is further constrained by the plugin's niche deployment footprint. Patchstack is the reporting source and the linked advisory is the only reference available.
Unauthenticated SQL injection in the Crowd Favorite DXP ToolKit WordPress plugin through version 2.0.1 allows remote attackers to read data from the underlying database, with the supplied assessment rating confidentiality impact as high and integrity and availability impact as none. The vulnerable endpoint or injectable parameter is not described in the available sources, and no public exploit code is identified at time of analysis. The vuln.today decision label is act_now, so remediation should be prioritized.
Stored cross-site scripting in the Crowd Favorite DXP ToolKit WordPress plugin, affecting versions from an unspecified starting point through 2.0.1, lets an attacker persist script content that executes in the browser of any user who later views the page rendering it. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) indicates network reachability and no privileges required, but a victim must load the affected page for the payload to fire, and the scope change reflects impact escaping the vulnerable component into the surrounding WordPress site. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is further constrained by the plugin's niche deployment footprint. Patchstack is the reporting source and the linked advisory is the only reference available.