Jettricks
Monthly
Stored cross-site scripting in the JetTricks WordPress plugin through version 2.0.1 lets an authenticated attacker with low-privilege content-contribution rights (PR:L) inject persistent script that executes in the browser of any user - typically an administrator - who later views the affected page (UI:R). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N for a base score of 6.5, a moderate rather than high priority, and the scope-change component reflects that the payload runs in the viewing user's session context, which may carry more privileges than the injector. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, so the main practical barrier for an attacker is the need for an authenticated account rather than anonymous access.
Stored cross-site scripting in the JetTricks WordPress plugin through version 2.0.1 lets an authenticated attacker with low-privilege content-contribution rights (PR:L) inject persistent script that executes in the browser of any user - typically an administrator - who later views the affected page (UI:R). The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N for a base score of 6.5, a moderate rather than high priority, and the scope-change component reflects that the payload runs in the viewing user's session context, which may carry more privileges than the injector. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, so the main practical barrier for an attacker is the need for an authenticated account rather than anonymous access.