Mandatory Field
Monthly
The Mandatory Field plugin for WordPress versions up to 1.6.8 contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings due to insufficient input sanitization and output escaping. Authenticated administrators can inject arbitrary JavaScript that executes for all users accessing affected pages, but exploitation is limited to multi-site WordPress installations or those with unfiltered_html disabled. With a CVSS score of 4.4 and high attack complexity, this represents a moderate-severity privilege escalation risk for WordPress administrators seeking to inject malicious scripts; no public POC or active exploitation has been indicated in KEV data.
The Mandatory Field plugin for WordPress versions up to 1.6.8 contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings due to insufficient input sanitization and output escaping. Authenticated administrators can inject arbitrary JavaScript that executes for all users accessing affected pages, but exploitation is limited to multi-site WordPress installations or those with unfiltered_html disabled. With a CVSS score of 4.4 and high attack complexity, this represents a moderate-severity privilege escalation risk for WordPress administrators seeking to inject malicious scripts; no public POC or active exploitation has been indicated in KEV data.