M Anh Fashion Woocoommerce Wordpress Theme
Monthly
Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; discovery was reported by Patchstack.
Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; discovery was reported by Patchstack.