Tailored Tools
Monthly
Unauthenticated cross-site scripting in the Tailored Tools WordPress plugin (versions 3.0.2 and earlier) allows a remote, unauthenticated attacker to inject malicious scripts that execute in the context of an authenticated victim's browser session. The scope change indicated by the CVSS vector (S:C) confirms that the injected payload crosses the plugin's security boundary into the victim's browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting in the Tailored Tools WordPress plugin (versions 3.0.2 and earlier) allows a remote, unauthenticated attacker to inject malicious scripts that execute in the context of an authenticated victim's browser session. The scope change indicated by the CVSS vector (S:C) confirms that the injected payload crosses the plugin's security boundary into the victim's browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation has been identified at time of analysis.