Responsive Starter Templates Elementor Templates Starter Sites
Monthly
Stored cross-site scripting in the CyberChimps Responsive Plus (Responsive Starter Templates - Elementor Templates & Starter Sites) plugin for WordPress affects all releases up to and including 3.5.3, letting an authenticated user with contributor-level access or higher plant arbitrary JavaScript in page content through shortcode attributes that are not sanitized on input or escaped on output; the script then runs in the browser of any user who loads the injected page. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the flaw is not confirmed actively exploited (no CISA KEV listing) and no public exploit code exists at time of analysis, which - combined with the contributor-or-above account prerequisite - keeps it below top-priority status relative to unauthenticated WordPress plugin flaws.
Stored cross-site scripting in the CyberChimps Responsive Plus (Responsive Starter Templates - Elementor Templates & Starter Sites) plugin for WordPress affects all releases up to and including 3.5.3, letting an authenticated user with contributor-level access or higher plant arbitrary JavaScript in page content through shortcode attributes that are not sanitized on input or escaped on output; the script then runs in the browser of any user who loads the injected page. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the flaw is not confirmed actively exploited (no CISA KEV listing) and no public exploit code exists at time of analysis, which - combined with the contributor-or-above account prerequisite - keeps it below top-priority status relative to unauthenticated WordPress plugin flaws.