Hubbub Lite
Monthly
Contributor-level stored Cross-Site Scripting in the Hubbub Lite WordPress plugin (versions <= 1.36.3) allows an authenticated attacker with Contributor role to inject persistent malicious JavaScript that executes in the browsers of higher-privileged users - including administrators - who subsequently view the affected content. The changed scope in the CVSS vector (S:C) confirms the payload escapes the contributor's own session context and can be used to hijack administrator sessions or perform unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis.
Contributor-level stored Cross-Site Scripting in the Hubbub Lite WordPress plugin (versions <= 1.36.3) allows an authenticated attacker with Contributor role to inject persistent malicious JavaScript that executes in the browsers of higher-privileged users - including administrators - who subsequently view the affected content. The changed scope in the CVSS vector (S:C) confirms the payload escapes the contributor's own session context and can be used to hijack administrator sessions or perform unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis.