Educavo
Monthly
Cross-site scripting in the Educavo WordPress theme through version 3.4.2 lets unauthenticated attackers get malicious script executed in the browser of a victim who is induced to load attacker-influenced content, with the change-of-scope vector (CVSS 7.1) reflecting that the injected code runs in the context of the targeted site. Exploitation requires user interaction, so delivery is effectively targeted (a crafted link or payload aimed at a site visitor or administrator) rather than automated mass compromise, and no public exploit code was identified at time of analysis. This is a moderate-priority issue rather than a critical one, and its reach is further limited to sites that actually run this specific theme.
Cross-site scripting in the Educavo WordPress theme through version 3.4.2 lets unauthenticated attackers get malicious script executed in the browser of a victim who is induced to load attacker-influenced content, with the change-of-scope vector (CVSS 7.1) reflecting that the injected code runs in the context of the targeted site. Exploitation requires user interaction, so delivery is effectively targeted (a crafted link or payload aimed at a site visitor or administrator) rather than automated mass compromise, and no public exploit code was identified at time of analysis. This is a moderate-priority issue rather than a critical one, and its reach is further limited to sites that actually run this specific theme.