Gloria Admin Panel
Monthly
Reflected cross-site scripting (CWE-79) in the bkninja 'Gloria Admin Panel' WordPress plugin, affecting versions through 1.3, allows an attacker to inject script into a page that executes in the browser of a victim who follows a crafted link while holding an active session - this maps to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1 High) per the supplied vector, with UI:R being the primary limiting factor since the victim must be socially engineered into clicking the link. The flaw is non-persistent (reflected), so the payload must be delivered per-victim rather than stored, and it targets the plugin's admin panel on WordPress installations that have the plugin installed and running version 1.3 or earlier. There is no confirmed active exploitation (CISA KEV not indicated) and no public exploit code identified at time of analysis; no vendor-released patch version was identified in the supplied data, though the Patchstack advisory is the authoritative tracking reference.
Reflected cross-site scripting (CWE-79) in the bkninja 'Gloria Admin Panel' WordPress plugin, affecting versions through 1.3, allows an attacker to inject script into a page that executes in the browser of a victim who follows a crafted link while holding an active session - this maps to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1 High) per the supplied vector, with UI:R being the primary limiting factor since the victim must be socially engineered into clicking the link. The flaw is non-persistent (reflected), so the payload must be delivered per-victim rather than stored, and it targets the plugin's admin panel on WordPress installations that have the plugin installed and running version 1.3 or earlier. There is no confirmed active exploitation (CISA KEV not indicated) and no public exploit code identified at time of analysis; no vendor-released patch version was identified in the supplied data, though the Patchstack advisory is the authoritative tracking reference.