Slim Jetpack
Monthly
Stored cross-site scripting in the Slim Jetpack WordPress plugin, affecting all versions through 2.7.0.1, lets unauthenticated visitors inject arbitrary script into the site through the 'website' contact field, submitted as the g<PAGE_ID>-website parameter. Nonce and authentication checks on form submission are enforced only for logged-in users, so anyone who can reach a page or post rendering the [contact-form] shortcode can store a payload that executes when a victim - often an administrator reviewing submissions - later views the injected content. The CVSS 3.1 vector is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); exploitation requires a published page carrying the shortcode, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Slim Jetpack WordPress plugin, affecting all versions through 2.7.0.1, lets unauthenticated visitors inject arbitrary script into the site through the 'website' contact field, submitted as the g<PAGE_ID>-website parameter. Nonce and authentication checks on form submission are enforced only for logged-in users, so anyone who can reach a page or post rendering the [contact-form] shortcode can store a payload that executes when a victim - often an administrator reviewing submissions - later views the injected content. The CVSS 3.1 vector is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); exploitation requires a published page carrying the shortcode, and no public exploit was identified at time of analysis.