Sogo Add Script To Individual Pages Header Footer
Monthly
Stored cross-site scripting in the SOGO Add Script to Individual Pages Header Footer WordPress plugin (through version 3.9) enables any contributor-level WordPress user to inject arbitrary JavaScript into per-post header and footer script fields without sanitization or capability gating. The payload executes in an administrator's browser when reviewing the pending post, enabling session hijacking and full site takeover, and persists for all site visitors once the post is published. A publicly available proof-of-concept exists per WPScan, though EPSS remains at 0.15% (5th percentile) and there is no CISA KEV listing, indicating limited opportunistic exploitation to date.
Stored cross-site scripting in the SOGO Add Script to Individual Pages Header Footer WordPress plugin (through version 3.9) enables any contributor-level WordPress user to inject arbitrary JavaScript into per-post header and footer script fields without sanitization or capability gating. The payload executes in an administrator's browser when reviewing the pending post, enabling session hijacking and full site takeover, and persists for all site visitors once the post is published. A publicly available proof-of-concept exists per WPScan, though EPSS remains at 0.15% (5th percentile) and there is no CISA KEV listing, indicating limited opportunistic exploitation to date.