Themehunk Customizer
Monthly
Reflected cross-site scripting (CWE-79) in the ThemeHunk Customizer WordPress plugin, affecting every version through 2.8.7, lets an unauthenticated remote attacker run arbitrary script in a victim's browser by convincing them to open a crafted URL containing the payload. Exploitation hinges on user interaction (UI:R) and is most dangerous when the victim is a logged-in administrator, because the injected script then executes with the privileges of the WordPress admin session; the flaw alone does not yield server-side access. No public exploit code and no CISA KEV entry were identified at time of analysis, and the issue was reported through Patchstack.
Reflected cross-site scripting (CWE-79) in the ThemeHunk Customizer WordPress plugin, affecting every version through 2.8.7, lets an unauthenticated remote attacker run arbitrary script in a victim's browser by convincing them to open a crafted URL containing the payload. Exploitation hinges on user interaction (UI:R) and is most dangerous when the victim is a logged-in administrator, because the injected script then executes with the privileges of the WordPress admin session; the flaw alone does not yield server-side access. No public exploit code and no CISA KEV entry were identified at time of analysis, and the issue was reported through Patchstack.