Jetproducttables
Monthly
Reflected cross-site scripting in the Crocoblock JetProductTables WordPress plugin (all versions through 1.2.4) allows an unauthenticated attacker to execute arbitrary script in a victim's browser by luring them to a crafted URL, which can lead to session theft or privileged actions such as content injection if an administrator clicks the link. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation depends on user interaction (UI:R) and the payload is not persisted; the advisory reports a base score of 7.1 while our independent impact assessment keeps confidentiality and integrity low with no availability impact. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, making this a social-engineering-dependent risk that matters most on sites where privileged users are likely to click untrusted links.
Reflected cross-site scripting in the Crocoblock JetProductTables WordPress plugin (all versions through 1.2.4) allows an unauthenticated attacker to execute arbitrary script in a victim's browser by luring them to a crafted URL, which can lead to session theft or privileged actions such as content injection if an administrator clicks the link. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation depends on user interaction (UI:R) and the payload is not persisted; the advisory reports a base score of 7.1 while our independent impact assessment keeps confidentiality and integrity low with no availability impact. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, making this a social-engineering-dependent risk that matters most on sites where privileged users are likely to click untrusted links.