Eonsr Aeo Agent
Monthly
Stored XSS with privilege bypass in the EONSR AEO Agent WordPress plugin (versions through 3.7.9) allows unauthenticated remote attackers to inject persistent arbitrary JavaScript into published posts, attributed to administrators, that executes in the browser of any site visitor including administrators. The REST API route responsible for post creation performs no authorization check and explicitly disables HTML sanitization before saving content, making this a trivially exploitable unauthenticated write-then-persist attack chain. A publicly available exploit has been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Stored XSS with privilege bypass in the EONSR AEO Agent WordPress plugin (versions through 3.7.9) allows unauthenticated remote attackers to inject persistent arbitrary JavaScript into published posts, attributed to administrators, that executes in the browser of any site visitor including administrators. The REST API route responsible for post creation performs no authorization check and explicitly disables HTML sanitization before saving content, making this a trivially exploitable unauthenticated write-then-persist attack chain. A publicly available exploit has been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.