Patterns Kit
Monthly
Stored XSS in the Patterns Kit WordPress plugin (versions through 1.0.3) enables any Contributor-level user to inject a JavaScript payload into an unescaped link attribute, which a client-side script inserts directly into the DOM. Victim browsers execute the payload when a user views the content and clicks the affected element, with the CVSS scope change (S:C) confirming the attack crosses from the WordPress application into the victim browser context. No vendor-released patch has been identified at time of analysis; a public proof-of-concept is available and the 16% EPSS score indicates above-average real-world exploitation probability for this severity class.
Stored XSS in the Patterns Kit WordPress plugin (versions through 1.0.3) enables any Contributor-level user to inject a JavaScript payload into an unescaped link attribute, which a client-side script inserts directly into the DOM. Victim browsers execute the payload when a user views the content and clicks the affected element, with the CVSS scope change (S:C) confirming the attack crosses from the WordPress application into the victim browser context. No vendor-released patch has been identified at time of analysis; a public proof-of-concept is available and the 16% EPSS score indicates above-average real-world exploitation probability for this severity class.