Pixfort Core
Monthly
Stored cross-site scripting in the WordPress plugin pixfort Core affects every release before 4.3.3, letting an authenticated attacker with Contributor-level access plant script content that runs in a higher-privileged user's browser once that user views, previews, or moderates it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) confirms the Contributor authentication barrier together with mandatory victim interaction, so the injected payload fires in an administrator or editor session rather than automatically - a scope-change condition that matters because the script executes with the victim's privileges. There is no indication of exploitation activity: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS figure supplied with the source data, so this should be treated as a genuine-but-low-priority issue and handled through routine plugin update cycles.
Stored cross-site scripting in the WordPress plugin pixfort Core affects every release before 4.3.3, letting an authenticated attacker with Contributor-level access plant script content that runs in a higher-privileged user's browser once that user views, previews, or moderates it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) confirms the Contributor authentication barrier together with mandatory victim interaction, so the injected payload fires in an administrator or editor session rather than automatically - a scope-change condition that matters because the script executes with the victim's privileges. There is no indication of exploitation activity: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS figure supplied with the source data, so this should be treated as a genuine-but-low-priority issue and handled through routine plugin update cycles.