Qode Music
Monthly
Qode Music WordPress plugin versions through 2.1.8.2 contain an unauthenticated cross-site scripting (XSS) vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows a remote attack with no attacker authentication, but success depends on luring a victim into interacting with a crafted request, so social engineering is required. No public exploit or active exploitation is identified at time of analysis, and the assessed risk is medium-tier rather than top priority.
Qode Music WordPress plugin versions through 2.1.8.2 contain an unauthenticated cross-site scripting (XSS) vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows a remote attack with no attacker authentication, but success depends on luring a victim into interacting with a crafted request, so social engineering is required. No public exploit or active exploitation is identified at time of analysis, and the assessed risk is medium-tier rather than top priority.