Sprout Clients
Monthly
Cross-Site Scripting in the BoldGrid Sprout Clients WordPress plugin (versions 3.2.3 and earlier) lets an unauthenticated attacker inject browser-executed script that runs in the context of a user who loads a crafted request or page. Because the CVSS vector shows PR:N with UI:R and a scope change (S:C), no account is needed but a victim must interact with a malicious link or page, after which script executes across a trust boundary into the victim's session. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
BoldGrid Sprout Clients contains a Stored Cross-Site Scripting (XSS) vulnerability in web page generation that allows authenticated users to inject and execute arbitrary JavaScript. The vulnerability affects Sprout Clients version 3.2.2 and earlier, enabling attackers with login credentials to compromise other users viewing affected pages. While the CVSS score of 6.5 indicates medium severity with network accessibility and low attack complexity, the stored nature of the XSS and requirement for user interaction (UI:R) limits immediate widespread automated exploitation.
Cross-Site Scripting in the BoldGrid Sprout Clients WordPress plugin (versions 3.2.3 and earlier) lets an unauthenticated attacker inject browser-executed script that runs in the context of a user who loads a crafted request or page. Because the CVSS vector shows PR:N with UI:R and a scope change (S:C), no account is needed but a victim must interact with a malicious link or page, after which script executes across a trust boundary into the victim's session. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
BoldGrid Sprout Clients contains a Stored Cross-Site Scripting (XSS) vulnerability in web page generation that allows authenticated users to inject and execute arbitrary JavaScript. The vulnerability affects Sprout Clients version 3.2.2 and earlier, enabling attackers with login credentials to compromise other users viewing affected pages. While the CVSS score of 6.5 indicates medium severity with network accessibility and low attack complexity, the stored nature of the XSS and requirement for user interaction (UI:R) limits immediate widespread automated exploitation.