Reactpress Create React App For Wordpress
Monthly
Stored cross-site scripting in ReactPress - Create React App for WordPress 3.4.0 and earlier lets authenticated attackers with subscriber-level access or higher poison pages with arbitrary JavaScript by supplying a crafted permalink. The plugin passes the value through sanitize_url() but then fetches the attacker-controlled remote URL and writes its raw response body to disk with file_put_contents(), so script tags and event handlers are persisted and later served to visitors. The issue has no public exploit identified at time of analysis, is not confirmed actively exploited (CISA KEV), and has a CVSS base score of 6.4 assessed as a genuine but bounded risk.
Stored cross-site scripting in ReactPress - Create React App for WordPress 3.4.0 and earlier lets authenticated attackers with subscriber-level access or higher poison pages with arbitrary JavaScript by supplying a crafted permalink. The plugin passes the value through sanitize_url() but then fetches the attacker-controlled remote URL and writes its raw response body to disk with file_put_contents(), so script tags and event handlers are persisted and later served to visitors. The issue has no public exploit identified at time of analysis, is not confirmed actively exploited (CISA KEV), and has a CVSS base score of 6.4 assessed as a genuine but bounded risk.