Leadconnector
Monthly
Unauthenticated stored or reflected Cross-Site Scripting in the LeadConnector WordPress plugin (versions ≤ 4.0.5) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser session without any prior authentication. The CVSS vector confirms a scope change (S:C), meaning the injected script escapes the plugin's context and can affect the broader WordPress session environment. No public exploit code or active exploitation has been identified at time of analysis, but the lack of authentication barrier lowers the effort required to attempt attacks at scale against WordPress installations.
The LeadConnector WordPress plugin before version 3.0.22 contains an authorization bypass vulnerability in a REST API endpoint, allowing unauthenticated attackers to overwrite existing data without authentication. This vulnerability affects an unknown vendor's LeadConnector product and has a publicly available proof-of-concept exploit, making it actively exploitable. The vulnerability enables unauthorized data manipulation, which could compromise business data integrity and customer information stored within the plugin.
Unauthenticated stored or reflected Cross-Site Scripting in the LeadConnector WordPress plugin (versions ≤ 4.0.5) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser session without any prior authentication. The CVSS vector confirms a scope change (S:C), meaning the injected script escapes the plugin's context and can affect the broader WordPress session environment. No public exploit code or active exploitation has been identified at time of analysis, but the lack of authentication barrier lowers the effort required to attempt attacks at scale against WordPress installations.
The LeadConnector WordPress plugin before version 3.0.22 contains an authorization bypass vulnerability in a REST API endpoint, allowing unauthenticated attackers to overwrite existing data without authentication. This vulnerability affects an unknown vendor's LeadConnector product and has a publicly available proof-of-concept exploit, making it actively exploitable. The vulnerability enables unauthorized data manipulation, which could compromise business data integrity and customer information stored within the plugin.