Simple Yearly Archive
Monthly
Stored Cross-Site Scripting in the Simple Yearly Archive WordPress plugin (all versions through 2.2.4) permits authenticated attackers holding Contributor-level access or higher to inject persistent malicious scripts via the `posttype` attribute of the `SimpleYearlyArchive` shortcode. The injected payload is stored in the WordPress database and executes in the browser of any visitor who loads the affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, placing current exploitation risk in the opportunistic-but-not-mass-exploitation tier.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in the Simple Yearly Archive WordPress plugin (all versions through 2.2.4) permits authenticated attackers holding Contributor-level access or higher to inject persistent malicious scripts via the `posttype` attribute of the `SimpleYearlyArchive` shortcode. The injected payload is stored in the WordPress database and executes in the browser of any visitor who loads the affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, placing current exploitation risk in the opportunistic-but-not-mass-exploitation tier.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.