Pond
Monthly
Reflected cross-site scripting in the SpabRice Pond WordPress theme (all versions through 2.6.1) lets a remote, unauthenticated attacker craft a URL containing a script payload that the theme reflects unsanitized into the generated page; the victim must be convinced to open that link (mandatory user interaction), so exploitation cannot occur without social engineering and nothing persists server-side. Impact per the assessed vector is low confidentiality and integrity loss with scope change, with the worst case being a lured authenticated administrator whose browser executes the script in a privileged session; no public exploit and no confirmed active exploitation were identified at time of analysis. Sites running this theme should treat the reflected payload as a phishing/CSRF-assist vector rather than a self-propagating compromise.
Reflected cross-site scripting in the SpabRice Pond WordPress theme (all versions through 2.6.1) lets a remote, unauthenticated attacker craft a URL containing a script payload that the theme reflects unsanitized into the generated page; the victim must be convinced to open that link (mandatory user interaction), so exploitation cannot occur without social engineering and nothing persists server-side. Impact per the assessed vector is low confidentiality and integrity loss with scope change, with the worst case being a lured authenticated administrator whose browser executes the script in a privileged session; no public exploit and no confirmed active exploitation were identified at time of analysis. Sites running this theme should treat the reflected payload as a phishing/CSRF-assist vector rather than a self-propagating compromise.