Slider Pro
Monthly
Stored/reflected Cross-Site Scripting in the bqworks Slider Pro WordPress plugin (versions 4.8.13 and earlier) allows a low-privileged Subscriber-level user to inject malicious script that executes in another user's browser. The flaw was reported by Patchstack and carries a CVSS 7.1 driven by a scope change (S:C). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is unproven in the wild.
Stored/reflected Cross-Site Scripting in the bqworks Slider Pro WordPress plugin (versions 4.8.13 and earlier) allows a low-privileged Subscriber-level user to inject malicious script that executes in another user's browser. The flaw was reported by Patchstack and carries a CVSS 7.1 driven by a scope change (S:C). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is unproven in the wild.