Po Mo Editor
Monthly
Stored cross-site scripting in the PO/MO Editor WordPress plugin, affecting all versions up to and including 1.4.2, allows an authenticated attacker with subscriber-level access or higher to inject arbitrary script through the 'podata' parameter, which the plugin persists and later serves as a replacement .po/.mo translation file via its load_textdomain_mofile filter. Because the injected translation is rendered for any visitor loading an affected page, a low-privilege account on a site with open registration enabled is sufficient to seed persistent script execution in other users' browsers; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) reflects network reachability, no user interaction beyond page view, scope change, and limited confidentiality and integrity impact with no availability effect. Exploitation requires the plugin to be installed and active plus a valid low-privilege account, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in the PO/MO Editor WordPress plugin, affecting all versions up to and including 1.4.2, allows an authenticated attacker with subscriber-level access or higher to inject arbitrary script through the 'podata' parameter, which the plugin persists and later serves as a replacement .po/.mo translation file via its load_textdomain_mofile filter. Because the injected translation is rendered for any visitor loading an affected page, a low-privilege account on a site with open registration enabled is sufficient to seed persistent script execution in other users' browsers; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) reflects network reachability, no user interaction beyond page view, scope change, and limited confidentiality and integrity impact with no availability effect. Exploitation requires the plugin to be installed and active plus a valid low-privilege account, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.