Progressify Progressive Web App Pwa
Monthly
Reflected/stored cross-site scripting in the WordPress plugin Progressify - Progressive Web App (PWA) at versions 1.6.0 and earlier lets an unauthenticated remote attacker inject script that executes in a victim's browser session, rated CVSS 3.1 base 7.1 with scope change. The vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms no authentication is needed to deliver the payload, but a victim must be induced to click a crafted link or visit a manipulated page before the script runs, which is the main limiting factor; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Sites running the affected plugin should treat any page reachable at or below 1.6.0 as exposed until upgraded.
Reflected/stored cross-site scripting in the WordPress plugin Progressify - Progressive Web App (PWA) at versions 1.6.0 and earlier lets an unauthenticated remote attacker inject script that executes in a victim's browser session, rated CVSS 3.1 base 7.1 with scope change. The vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) confirms no authentication is needed to deliver the payload, but a victim must be induced to click a crafted link or visit a manipulated page before the script runs, which is the main limiting factor; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Sites running the affected plugin should treat any page reachable at or below 1.6.0 as exposed until upgraded.