Http Requests Manager
Monthly
Cross-site scripting in the WordPress plugin HTTP Requests Manager affects all versions up to and including 1.3.11, allowing an unauthenticated remote attacker to inject script that executes in the browser of a user who interacts with attacker-controlled input (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is required to deliver the payload, but the script only fires when a logged-in victim - most damagingly a site administrator - is socially engineered into clicking a crafted link or loading an attacker-influenced page or parameter handled by the plugin, so this is not an unattended server-side compromise path. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency.
Cross-site scripting in the WordPress plugin HTTP Requests Manager affects all versions up to and including 1.3.11, allowing an unauthenticated remote attacker to inject script that executes in the browser of a user who interacts with attacker-controlled input (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is required to deliver the payload, but the script only fires when a logged-in victim - most damagingly a site administrator - is socially engineered into clicking a crafted link or loading an attacker-influenced page or parameter handled by the plugin, so this is not an unattended server-side compromise path. No confirmed active exploitation (not in CISA KEV) and no public exploit code was identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency.