Saitama Addon Pack
Monthly
Stored XSS in the Saitama Addon Pack WordPress plugin (≤ 1.0.8) lets contributor-level users inject persistent JavaScript into post metadata fields that have no sanitization or escaping applied before output. When a higher-privileged user - editor or administrator - opens the affected content for review, the payload executes in their browser session. A public exploit is available via WPScan; no active exploitation is recorded in CISA KEV, and EPSS sits at the 6th percentile, consistent with targeted rather than opportunistic abuse.
Stored XSS in the Saitama Addon Pack WordPress plugin (≤ 1.0.8) lets contributor-level users inject persistent JavaScript into post metadata fields that have no sanitization or escaping applied before output. When a higher-privileged user - editor or administrator - opens the affected content for review, the payload executes in their browser session. A public exploit is available via WPScan; no active exploitation is recorded in CISA KEV, and EPSS sits at the 6th percentile, consistent with targeted rather than opportunistic abuse.