Typing Effect
Monthly
Stored Cross-Site Scripting in the Typing Effect WordPress plugin (versions ≤ 1.3.7) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browsers of other users, including administrators, who visit affected pages. The CVSS vector (PR:L/UI:R/S:C) confirms the flaw is exploitable by low-privilege authenticated accounts and that the scope change elevates impact beyond the contributor's own session - enabling session hijacking or administrative action forgery. No public exploit code identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in the Typing Effect WordPress plugin (versions ≤ 1.3.7) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browsers of other users, including administrators, who visit affected pages. The CVSS vector (PR:L/UI:R/S:C) confirms the flaw is exploitable by low-privilege authenticated accounts and that the scope change elevates impact beyond the contributor's own session - enabling session hijacking or administrative action forgery. No public exploit code identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.