Parsi Date
Monthly
Reflected cross-site scripting in the Parsi Date (wp-parsidate) WordPress plugin, affecting all versions up to and including 6.3, allows an unauthenticated remote attacker to inject script into a victim's browser by getting that user to load a crafted URL or request. Tracked as CVE-2026-96836 with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw carries low confidentiality, integrity and availability impacts because execution is limited to client-side script in the victim's session rather than server-side code execution, and exploitation requires victim user interaction (UI:R) since the target must click or load the malicious link. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV), though as a broadly deployed WordPress plugin it presents an attractive mass-scanning target for unauthenticated request campaigns.
Reflected cross-site scripting in the Parsi Date (wp-parsidate) WordPress plugin, affecting all versions up to and including 6.3, allows an unauthenticated remote attacker to inject script into a victim's browser by getting that user to load a crafted URL or request. Tracked as CVE-2026-96836 with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw carries low confidentiality, integrity and availability impacts because execution is limited to client-side script in the victim's session rather than server-side code execution, and exploitation requires victim user interaction (UI:R) since the target must click or load the malicious link. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV), though as a broadly deployed WordPress plugin it presents an attractive mass-scanning target for unauthenticated request campaigns.