Loops Logic
Monthly
Cross-site scripting in Tangible Loops & Logic, a WordPress templating plugin by Tangible, allows network-accessible attackers to inject malicious scripts into web pages served to other users. The CVSS vector (PR:N/UI:N) suggests unauthenticated stored XSS where payloads execute without additional victim interaction beyond normal page visits, though this rating is atypical for XSS and warrants verification. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and lack of authentication requirement make this straightforward to exploit once the injection vector is identified.
Stored cross-site scripting in the Tangible Loops & Logic WordPress plugin (versions through 4.2.3) allows a low-privileged authenticated user to inject persistent malicious scripts into web pages that execute in the browsers of site visitors or administrators. The scope change (S:C in CVSS) confirms the payload escapes the injection context and executes in a victim's browser session, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to exploit once an attacker holds contributor-level access.
Cross-site scripting in Tangible Loops & Logic, a WordPress templating plugin by Tangible, allows network-accessible attackers to inject malicious scripts into web pages served to other users. The CVSS vector (PR:N/UI:N) suggests unauthenticated stored XSS where payloads execute without additional victim interaction beyond normal page visits, though this rating is atypical for XSS and warrants verification. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and lack of authentication requirement make this straightforward to exploit once the injection vector is identified.
Stored cross-site scripting in the Tangible Loops & Logic WordPress plugin (versions through 4.2.3) allows a low-privileged authenticated user to inject persistent malicious scripts into web pages that execute in the browsers of site visitors or administrators. The scope change (S:C in CVSS) confirms the payload escapes the injection context and executes in a victim's browser session, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforward to exploit once an attacker holds contributor-level access.