Profile Extra Fields By Bestwebsoft
Monthly
Stored cross-site scripting in the Profile Extra Fields by BestWebSoft WordPress plugin (versions ≤1.3.4) allows an authenticated subscriber-level user to inject arbitrary JavaScript into custom profile fields, which then executes in the browser of any higher-privileged user who views the affected profile - including site administrators. The scope-changed impact (S:C) is the key risk multiplier: a minimally privileged attacker can potentially hijack admin sessions or perform unauthorized actions on behalf of victims. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Profile Extra Fields by BestWebSoft WordPress plugin (versions ≤1.3.4) allows an authenticated subscriber-level user to inject arbitrary JavaScript into custom profile fields, which then executes in the browser of any higher-privileged user who views the affected profile - including site administrators. The scope-changed impact (S:C) is the key risk multiplier: a minimally privileged attacker can potentially hijack admin sessions or perform unauthorized actions on behalf of victims. No public exploit code or active exploitation has been identified at time of analysis.