Themestek Extras For Labtechco Theme
Monthly
Reflected cross-site scripting (CWE-79) in the WordPress plugin ThemeStek Extras for LabtechCO Theme, affecting all versions through 8.4, allows an unauthenticated attacker to inject script that executes in a victim's browser when a crafted URL is visited. Exploitation is constrained because the payload is not stored: an attacker must lure a victim into clicking a malicious link (CVSS UI:R), and the target site must have this specific plugin installed and active. The flaw is rated CVSS 7.1 with scope change (S:C) and low confidentiality, integrity and availability impacts; no public exploit code has been identified at time of analysis.
Reflected cross-site scripting (CWE-79) in the WordPress plugin ThemeStek Extras for LabtechCO Theme, affecting all versions through 8.4, allows an unauthenticated attacker to inject script that executes in a victim's browser when a crafted URL is visited. Exploitation is constrained because the payload is not stored: an attacker must lure a victim into clicking a malicious link (CVSS UI:R), and the target site must have this specific plugin installed and active. The flaw is rated CVSS 7.1 with scope change (S:C) and low confidentiality, integrity and availability impacts; no public exploit code has been identified at time of analysis.