Siteorigin Css
Monthly
Stored DOM-based cross-site scripting in SiteOrigin CSS 1.6.7 and earlier allows unauthenticated attackers to inject scripts through the WordPress comment 'Website' (comment_author_url) field, executing when a victim loads a page where the plugin renders the stored comment URL into a DOM sink. Exploitation requires the site to accept comments from unauthenticated visitors and to use an affected plugin version; the CVSS 3.1 score of 7.2 reflects network reachability, low complexity, no authentication, and a scope change, with limited confidentiality and integrity impact. No public exploit code was identified at time of analysis.
Stored DOM-based cross-site scripting in the SiteOrigin CSS WordPress plugin (all versions up to and including 1.6.7) lets an unauthenticated attacker smuggle script into a page via the 'href' parameter, which the plugin's Visual Inspector later writes into the DOM without sanitization. Exploitation is not self-firing: the attacker's comment must survive moderation and be approved, and an administrator must subsequently open the Visual Inspector and manually click the injected anchor link - a mandatory user-interaction step that the CVSS base vector understates (our assessment re-scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N versus the published 7.2). There is no confirmed active exploitation or public exploit code identified at time of analysis, and the practical impact is bounded to script execution in an authenticated administrator's browser context.
Stored DOM-based cross-site scripting in SiteOrigin CSS 1.6.7 and earlier allows unauthenticated attackers to inject scripts through the WordPress comment 'Website' (comment_author_url) field, executing when a victim loads a page where the plugin renders the stored comment URL into a DOM sink. Exploitation requires the site to accept comments from unauthenticated visitors and to use an affected plugin version; the CVSS 3.1 score of 7.2 reflects network reachability, low complexity, no authentication, and a scope change, with limited confidentiality and integrity impact. No public exploit code was identified at time of analysis.
Stored DOM-based cross-site scripting in the SiteOrigin CSS WordPress plugin (all versions up to and including 1.6.7) lets an unauthenticated attacker smuggle script into a page via the 'href' parameter, which the plugin's Visual Inspector later writes into the DOM without sanitization. Exploitation is not self-firing: the attacker's comment must survive moderation and be approved, and an administrator must subsequently open the Visual Inspector and manually click the injected anchor link - a mandatory user-interaction step that the CVSS base vector understates (our assessment re-scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N versus the published 7.2). There is no confirmed active exploitation or public exploit code identified at time of analysis, and the practical impact is bounded to script execution in an authenticated administrator's browser context.