Pin Wp
Monthly
Reflected cross-site scripting in the an-themes Pin WP WordPress theme (versions 7.0 and earlier) allows an unauthenticated remote attacker to execute arbitrary script in a victim's browser by luring them to a specially crafted URL that reflects unsanitized input. Exploitation is gated by mandatory user interaction - no credentials are required, but the payload only fires if the victim clicks the attacker-supplied link - and the impact is worst when that victim is a logged-in site administrator, since the injected script inherits the site's origin (CVSS 7.1, S:C). No CISA KEV entry, no confirmed public exploit code, and no vendor-released patch were present in the available intelligence, so this rates as a moderate-risk, not top-priority, issue that nevertheless warrants prompt attention because of the volume of unauthenticated attackers who could attempt it.
Reflected cross-site scripting in the an-themes Pin WP WordPress theme (versions 7.0 and earlier) allows an unauthenticated remote attacker to execute arbitrary script in a victim's browser by luring them to a specially crafted URL that reflects unsanitized input. Exploitation is gated by mandatory user interaction - no credentials are required, but the payload only fires if the victim clicks the attacker-supplied link - and the impact is worst when that victim is a logged-in site administrator, since the injected script inherits the site's origin (CVSS 7.1, S:C). No CISA KEV entry, no confirmed public exploit code, and no vendor-released patch were present in the available intelligence, so this rates as a moderate-risk, not top-priority, issue that nevertheless warrants prompt attention because of the volume of unauthenticated attackers who could attempt it.