Off Canvas Sidebars Menus Slidebars
Monthly
Stored cross-site scripting in the WordPress plugin Off-Canvas Sidebars & Menus (Slidebars) through version 0.5.9 lets an authenticated user holding only low privileges place unsanitized input into a page that is later rendered in another user's browser, executing script in that victim's session (CVSS 6.5, scope changed). Per the assessed vector (PR:L/UI:R) the attacker must already hold a valid WordPress account and must persuade a victim to view the affected page; confidentiality, integrity and availability impact are each rated Low and confined to the browser context rather than server compromise. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and no EPSS score was supplied, so the decision signal is this-month remediation rather than emergency response.
Stored cross-site scripting in the WordPress plugin Off-Canvas Sidebars & Menus (Slidebars) through version 0.5.9 lets an authenticated user holding only low privileges place unsanitized input into a page that is later rendered in another user's browser, executing script in that victim's session (CVSS 6.5, scope changed). Per the assessed vector (PR:L/UI:R) the attacker must already hold a valid WordPress account and must persuade a victim to view the affected page; confidentiality, integrity and availability impact are each rated Low and confined to the browser context rather than server compromise. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and no EPSS score was supplied, so the decision signal is this-month remediation rather than emergency response.