Oauth Server
Monthly
Cross-site scripting in the WordPress OAuth Server plugin (oauth2-provider) through version 4.5.1 lets an authenticated Contributor-level user inject script that executes in the browser of a higher-privileged victim who views the affected page. Because exploitation requires a valid low-privilege account plus victim interaction, exposure is limited on sites that do not allow untrusted registration or Contributor roles, and the issue is a moderate-severity, low-real-world-priority one (CVSS 6.5). No public exploit code was identified at time of analysis, and the specific vulnerable field or parameter is not documented in the available Patchstack advisory.
Cross-site scripting in the WordPress OAuth Server plugin (oauth2-provider) through version 4.5.1 lets an authenticated Contributor-level user inject script that executes in the browser of a higher-privileged victim who views the affected page. Because exploitation requires a valid low-privilege account plus victim interaction, exposure is limited on sites that do not allow untrusted registration or Contributor roles, and the issue is a moderate-severity, low-real-world-priority one (CVSS 6.5). No public exploit code was identified at time of analysis, and the specific vulnerable field or parameter is not documented in the available Patchstack advisory.