Sidebar Manager Light
Monthly
Stored XSS in the Sidebar Manager Light WordPress plugin (all versions through 1.18) allows unauthenticated attackers to permanently inject malicious JavaScript via the `sbm_description` parameter into pages served to any site visitor. The scope-changed impact means attacker-controlled scripts execute within victims' browsers rather than solely the plugin's own context, enabling session hijacking, credential phishing, or drive-by malware delivery. No public exploit code has been identified at time of analysis, and the plugin's limited deployment footprint constrains real-world exposure.
Stored XSS in the Sidebar Manager Light WordPress plugin (all versions through 1.18) allows unauthenticated attackers to permanently inject malicious JavaScript via the `sbm_description` parameter into pages served to any site visitor. The scope-changed impact means attacker-controlled scripts execute within victims' browsers rather than solely the plugin's own context, enabling session hijacking, credential phishing, or drive-by malware delivery. No public exploit code has been identified at time of analysis, and the plugin's limited deployment footprint constrains real-world exposure.