Virtue Ascend Pinnacle Toolkit
Monthly
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.