Trustedsite
Monthly
Unauthenticated cross-site scripting in the TrustedSite WordPress plugin (versions <=1.2.5) allows remote attackers without any credentials to inject arbitrary JavaScript into pages served to site visitors or administrators. The CVSS vector designates a scope change (S:C), meaning the injected script executes in the victim's browser context and can affect resources beyond the vulnerable WordPress installation itself - including session cookies and browser-stored credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated entry point and low attack complexity make this a realistic risk on any unpatched deployment.
Unauthenticated cross-site scripting in the TrustedSite WordPress plugin (versions <=1.2.5) allows remote attackers without any credentials to inject arbitrary JavaScript into pages served to site visitors or administrators. The CVSS vector designates a scope change (S:C), meaning the injected script executes in the victim's browser context and can affect resources beyond the vulnerable WordPress installation itself - including session cookies and browser-stored credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated entry point and low attack complexity make this a realistic risk on any unpatched deployment.