Parallax Section Block
Monthly
Unauthenticated cross-site scripting in the bplugins 'Parallax Section' WordPress block plugin through version 2.0.4 allows remote attackers to inject script that executes in a victim's browser when the affected block renders attacker-controlled input. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) - a victim must load or interact with the page containing the injected payload - and the impact is confined to the victim's browser context rather than direct server compromise, so overall risk is moderate and heavily gated by user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the available data does not specify a fixed plugin version.
Unauthenticated cross-site scripting in the bplugins 'Parallax Section' WordPress block plugin through version 2.0.4 allows remote attackers to inject script that executes in a victim's browser when the affected block renders attacker-controlled input. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) - a victim must load or interact with the page containing the injected payload - and the impact is confined to the victim's browser context rather than direct server compromise, so overall risk is moderate and heavily gated by user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the available data does not specify a fixed plugin version.