Pluginops
Monthly
Unauthenticated reflected or stored Cross-Site Scripting in the MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. Exploitation requires victim interaction (UI:R) but no attacker authentication, and carries a scope change (S:C), meaning the injected script executes in the victim's browser context outside the plugin's own sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
Cross-site scripting in the PluginOps Landing Page Builder WordPress plugin (versions <= 1.5.3.5) lets unauthenticated remote attackers inject script that executes in a victim's browser, with a scope change (S:C) indicating the payload can affect resources beyond the vulnerable component. The flaw requires victim interaction (UI:R) such as visiting a crafted link or page, and yields low-level confidentiality, integrity, and availability impact (CVSS 7.1). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder - Lead Page - Optin Page - Squeeze Page - WordPress Landing Pages.5.1.5. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated reflected or stored Cross-Site Scripting in the MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. Exploitation requires victim interaction (UI:R) but no attacker authentication, and carries a scope change (S:C), meaning the injected script executes in the victim's browser context outside the plugin's own sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
Cross-site scripting in the PluginOps Landing Page Builder WordPress plugin (versions <= 1.5.3.5) lets unauthenticated remote attackers inject script that executes in a victim's browser, with a scope change (S:C) indicating the payload can affect resources beyond the vulnerable component. The flaw requires victim interaction (UI:R) such as visiting a crafted link or page, and yields low-level confidentiality, integrity, and availability impact (CVSS 7.1). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps Landing Page Builder - Lead Page - Optin Page - Squeeze Page - WordPress Landing Pages.5.1.5. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.