Hashthemes Demo Importer
Monthly
Cross-site scripting in the HashThemes Demo Importer WordPress plugin (versions up to and including 1.4.2) allows a high-privileged attacker to inject malicious scripts into author-related fields that execute in other users' browsers when the affected content is viewed. The vulnerability carries a scope change (S:C), meaning a compromised author context can impact administrative sessions, potentially enabling session hijacking or unauthorized actions on behalf of a victim admin. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting in the HashThemes Demo Importer WordPress plugin (versions up to and including 1.4.2) allows a high-privileged attacker to inject malicious scripts into author-related fields that execute in other users' browsers when the affected content is viewed. The vulnerability carries a scope change (S:C), meaning a compromised author context can impact administrative sessions, potentially enabling session hijacking or unauthorized actions on behalf of a victim admin. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.