Email Essentials
Monthly
Unauthenticated Cross-Site Scripting in the Email Essentials WordPress plugin by Acato (all versions through 6.0.6) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack is network-accessible, requires no privileges, and carries a scope change indicating the injected script runs in the victim's browser context rather than the server's. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Email Essentials WordPress plugin by Acato (all versions through 6.0.6) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack is network-accessible, requires no privileges, and carries a scope change indicating the injected script runs in the victim's browser context rather than the server's. No public exploit code or CISA KEV listing has been identified at time of analysis.