Keyword Collector
Monthly
Stored cross-site scripting in the WordPress plugin KeyWord Collector through version 1.4 allows an unauthenticated remote attacker to POST arbitrary values directly to the plugin's settings-save routine, which enforces neither a capability/authorization check nor a nonce (CSRF) check, and the stored values are then rendered without output escaping. The injected JavaScript executes when a logged-in administrator later opens the plugin settings page, or when any site visitor loads a front-end page that displays the plugin's output; publicly available exploit code exists for this issue. Our independent assessment scores the flaw 6.1 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which is more conservative than the 8.8 figure circulated elsewhere: exploitation is unauthenticated and requires no non-default configuration, but it is constrained by user interaction (UI:R) and the demonstrated consequence is script execution in a victim's browser session rather than direct server-side compromise.
Stored cross-site scripting in the WordPress plugin KeyWord Collector through version 1.4 allows an unauthenticated remote attacker to POST arbitrary values directly to the plugin's settings-save routine, which enforces neither a capability/authorization check nor a nonce (CSRF) check, and the stored values are then rendered without output escaping. The injected JavaScript executes when a logged-in administrator later opens the plugin settings page, or when any site visitor loads a front-end page that displays the plugin's output; publicly available exploit code exists for this issue. Our independent assessment scores the flaw 6.1 under CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which is more conservative than the 8.8 figure circulated elsewhere: exploitation is unauthenticated and requires no non-default configuration, but it is constrained by user interaction (UI:R) and the demonstrated consequence is script execution in a victim's browser session rather than direct server-side compromise.