Machete
Monthly
Stored Cross-Site Scripting in the Machete WordPress plugin (versions <= 5.2) allows authenticated users with Author-level privileges to inject malicious scripts into content that executes in victims' browsers when viewed. The vulnerability is classified as CWE-79 and carries a CVSS 5.9 score reflecting the scope change (S:C) typical of stored XSS, where payload execution occurs in a separate security context from where it was injected. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the attack vector is network-accessible with low complexity once attacker-controlled credentials are obtained.
Stored Cross-Site Scripting in the Machete WordPress plugin (versions <= 5.2) allows authenticated users with Author-level privileges to inject malicious scripts into content that executes in victims' browsers when viewed. The vulnerability is classified as CWE-79 and carries a CVSS 5.9 score reflecting the scope change (S:C) typical of stored XSS, where payload execution occurs in a separate security context from where it was injected. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the attack vector is network-accessible with low complexity once attacker-controlled credentials are obtained.