Transbank Webpay
Monthly
Stored cross-site scripting in the Transbank Webpay WordPress plugin before 1.14.0 lets unauthenticated visitors inject malicious script into plugin log entries that execute in the browser of any administrator who later views the logs. Because injection requires no authentication and the payload runs in a privileged admin session, it can be used to hijack the WordPress backend; publicly available exploit code exists and a public write-up chains the flaw toward remote code execution. EPSS is low (0.16%, 6th percentile) and CISA SSVC records no observed exploitation, so real-world targeting appears limited despite the high CVSS of 7.1.
Stored cross-site scripting in the Transbank Webpay WordPress plugin before 1.14.0 lets unauthenticated visitors inject malicious script into plugin log entries that execute in the browser of any administrator who later views the logs. Because injection requires no authentication and the payload runs in a privileged admin session, it can be used to hijack the WordPress backend; publicly available exploit code exists and a public write-up chains the flaw toward remote code execution. EPSS is low (0.16%, 6th percentile) and CISA SSVC records no observed exploitation, so real-world targeting appears limited despite the high CVSS of 7.1.