Loops Logic
Monthly
Unauthenticated remote attackers can read protected data from WordPress sites running the Tangible Loops & Logic plugin at version 4.2.4 or earlier, because the plugin fails to enforce proper authorization on a reachable feature (CWE-862 broken access control). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 HIGH) confirms the flaw is network-reachable with no authentication, no privileges, and no user interaction, and the impact is limited to confidentiality - no modification or availability effect is possible. Exploitation requires only that the plugin be installed and active; there is no public exploit identified at time of analysis, and exposure is bounded because the plugin is a niche, developer-oriented templating tool rather than a widely deployed one.
Unauthenticated information disclosure in the Loops & Logic WordPress plugin (all versions before 4.3.0) exposes arbitrary user records - including email addresses and role assignments - and arbitrary site configuration options to any unauthenticated visitor. The plugin's public template-data AJAX action fails to enforce access controls, permitting unauthenticated HTTP requests to retrieve data restricted to privileged users. A publicly available proof-of-concept exists per the WPScan advisory; however, EPSS at 0.17% (7th percentile) and SSVC 'exploitation: none' indicate no confirmed active exploitation at time of analysis.
Cross-site scripting in Tangible Loops & Logic, a WordPress templating plugin by Tangible, allows network-accessible attackers to inject malicious scripts into web pages served to other users. The CVSS vector (PR:N/UI:N) suggests unauthenticated stored XSS where payloads execute without additional victim interaction beyond normal page visits, though this rating is atypical for XSS and warrants verification. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and lack of authentication requirement make this straightforward to exploit once the injection vector is identified.
Stored cross-site scripting in the Tangible Loops & Logic WordPress plugin (versions through 4.2.3) allows a low-privileged authenticated user to inject persistent malicious scripts into web pages that execute in the browsers of site visitors or administrators. The scope change (S:C in CVSS) confirms the payload escapes the injection context and executes in a victim's browser session, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to exploit once an attacker holds contributor-level access.
Unauthenticated remote attackers can read protected data from WordPress sites running the Tangible Loops & Logic plugin at version 4.2.4 or earlier, because the plugin fails to enforce proper authorization on a reachable feature (CWE-862 broken access control). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 HIGH) confirms the flaw is network-reachable with no authentication, no privileges, and no user interaction, and the impact is limited to confidentiality - no modification or availability effect is possible. Exploitation requires only that the plugin be installed and active; there is no public exploit identified at time of analysis, and exposure is bounded because the plugin is a niche, developer-oriented templating tool rather than a widely deployed one.
Unauthenticated information disclosure in the Loops & Logic WordPress plugin (all versions before 4.3.0) exposes arbitrary user records - including email addresses and role assignments - and arbitrary site configuration options to any unauthenticated visitor. The plugin's public template-data AJAX action fails to enforce access controls, permitting unauthenticated HTTP requests to retrieve data restricted to privileged users. A publicly available proof-of-concept exists per the WPScan advisory; however, EPSS at 0.17% (7th percentile) and SSVC 'exploitation: none' indicate no confirmed active exploitation at time of analysis.
Cross-site scripting in Tangible Loops & Logic, a WordPress templating plugin by Tangible, allows network-accessible attackers to inject malicious scripts into web pages served to other users. The CVSS vector (PR:N/UI:N) suggests unauthenticated stored XSS where payloads execute without additional victim interaction beyond normal page visits, though this rating is atypical for XSS and warrants verification. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and lack of authentication requirement make this straightforward to exploit once the injection vector is identified.
Stored cross-site scripting in the Tangible Loops & Logic WordPress plugin (versions through 4.2.3) allows a low-privileged authenticated user to inject persistent malicious scripts into web pages that execute in the browsers of site visitors or administrators. The scope change (S:C in CVSS) confirms the payload escapes the injection context and executes in a victim's browser session, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to exploit once an attacker holds contributor-level access.