Twenty20 Image Before After
Monthly
Stored cross-site scripting in the WordPress plugin Twenty20 Image Before-After (all versions up to and including 2.0.5) allows authenticated users with contributor-level access or above to inject arbitrary JavaScript through the 'offset' attribute of the plugin's shortcode; the injected script is stored in a post and executes when another user, such as an editor or administrator, later views that page. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (6.4), reflecting a network-reachable, low-privilege, no-user-interaction attack with changed scope but limited confidentiality and integrity impact, and authentication is mandatory, so sites that restrict contributor accounts or disable open registration materially reduce exposure. No CISA KEV entry or public exploit code was identified at time of analysis, and the plugin's Trac changeset indicates a 2.0.6 tag superseding 2.0.5.
Stored cross-site scripting in the WordPress plugin Twenty20 Image Before-After (all versions up to and including 2.0.5) allows authenticated users with contributor-level access or above to inject arbitrary JavaScript through the 'offset' attribute of the plugin's shortcode; the injected script is stored in a post and executes when another user, such as an editor or administrator, later views that page. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (6.4), reflecting a network-reachable, low-privilege, no-user-interaction attack with changed scope but limited confidentiality and integrity impact, and authentication is mandatory, so sites that restrict contributor accounts or disable open registration materially reduce exposure. No CISA KEV entry or public exploit code was identified at time of analysis, and the plugin's Trac changeset indicates a 2.0.6 tag superseding 2.0.5.