Ohio Extra
Monthly
Authenticated subscriber-level cross-site scripting (XSS) in the Ohio Extra WordPress plugin up to version 3.6.8 allows attackers with a subscriber account or higher to inject arbitrary JavaScript that executes in the browser of a higher-privileged user who views the injected content. The independent assessment rates this as a moderate-risk issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) with no availability impact, requiring victim interaction and confined to browser-context script execution rather than server compromise. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Authenticated subscriber-level cross-site scripting (XSS) in the Ohio Extra WordPress plugin up to version 3.6.8 allows attackers with a subscriber account or higher to inject arbitrary JavaScript that executes in the browser of a higher-privileged user who views the injected content. The independent assessment rates this as a moderate-risk issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) with no availability impact, requiring victim interaction and confined to browser-context script execution rather than server compromise. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).