Flying Scripts
Monthly
Unauthenticated stored cross-site scripting in the WordPress plugin Flying Scripts (Delay JavaScript to Improve Site Speed & Performance) through 1.2.4 lets attackers inject script through comment input that the plugin's output-buffer rewriter later re-emits into an HTML attribute. The bypass relies on a crafted payload using only WordPress kses-allowed markup-an <abbr title> attribute plus a double-quote-bearing <code> body-and the plugin's predictable unsalted ___noise___ placeholder substitution, so the script executes when a victim views the affected page. No public exploit identified at time of analysis, and exploitation requires the vulnerable plugin to be installed with its rewriting active and a comment or equivalent input path enabled, making this a moderate-priority issue despite the CVSS 7.2 scope-changed rating.
Unauthenticated stored cross-site scripting in the WordPress plugin Flying Scripts (Delay JavaScript to Improve Site Speed & Performance) through 1.2.4 lets attackers inject script through comment input that the plugin's output-buffer rewriter later re-emits into an HTML attribute. The bypass relies on a crafted payload using only WordPress kses-allowed markup-an <abbr title> attribute plus a double-quote-bearing <code> body-and the plugin's predictable unsalted ___noise___ placeholder substitution, so the script executes when a victim views the affected page. No public exploit identified at time of analysis, and exploitation requires the vulnerable plugin to be installed with its rewriting active and a comment or equivalent input path enabled, making this a moderate-priority issue despite the CVSS 7.2 scope-changed rating.