Prenotazioni
Monthly
Stored cross-site scripting in the Prenotazioni WordPress plugin (all versions up to and including 1.7.5) lets an unauthenticated attacker write arbitrary JavaScript into plugin settings that are saved without any capability or CSRF check and then rendered without output escaping. The payload persists in the site database and executes in the browser of any administrator opening the affected settings screen or any visitor viewing the affected front-end rendering, so impact is scoped to the privileges of the victim's own session rather than to the server itself. A public proof-of-concept/write-up is available (WPScan), while SSVC records exploitation status as 'none' and non-automatable; no EPSS score was supplied. Note the discrepancy between the researcher-assigned 8.8 (S:U/C:H/I:H/A:H) and our independent assessment (S:C/C:L/I:L/A:N), which treats confidentiality and integrity impact as limited because execution requires a page view (UI:R) and only affects the victim's browser session.
Stored cross-site scripting in the Prenotazioni WordPress plugin (all versions up to and including 1.7.5) lets an unauthenticated attacker write arbitrary JavaScript into plugin settings that are saved without any capability or CSRF check and then rendered without output escaping. The payload persists in the site database and executes in the browser of any administrator opening the affected settings screen or any visitor viewing the affected front-end rendering, so impact is scoped to the privileges of the victim's own session rather than to the server itself. A public proof-of-concept/write-up is available (WPScan), while SSVC records exploitation status as 'none' and non-automatable; no EPSS score was supplied. Note the discrepancy between the researcher-assigned 8.8 (S:U/C:H/I:H/A:H) and our independent assessment (S:C/C:L/I:L/A:N), which treats confidentiality and integrity impact as limited because execution requires a page view (UI:R) and only affects the victim's browser session.