Fusedesk
Monthly
The FuseDesk WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the fusedesk_newcase shortcode that fails to properly sanitize and escape the 'emailtext' attribute. Authenticated attackers with Contributor-level access or higher can inject malicious scripts into WordPress pages that execute for all subsequent visitors. The vulnerability affects all versions up to and including 6.8, with a CVSS score of 6.4 indicating moderate severity; no KEV or active exploitation data is currently documented, but the low attack complexity and network accessibility make this a meaningful concern for multi-user WordPress installations.
The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusedesk_newcase' shortcode in all versions up to, and including, 6.6.1 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The FuseDesk WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the fusedesk_newcase shortcode that fails to properly sanitize and escape the 'emailtext' attribute. Authenticated attackers with Contributor-level access or higher can inject malicious scripts into WordPress pages that execute for all subsequent visitors. The vulnerability affects all versions up to and including 6.8, with a CVSS score of 6.4 indicating moderate severity; no KEV or active exploitation data is currently documented, but the low attack complexity and network accessibility make this a meaningful concern for multi-user WordPress installations.
The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusedesk_newcase' shortcode in all versions up to, and including, 6.6.1 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.