Virtue Ascend Pinnacle Toolkit
Monthly
Cross-site scripting (XSS) in the Virtue/Ascend/Pinnacle Toolkit WordPress plugin allows an authenticated Contributor-level user to inject malicious script that executes in a higher-privileged user's browser when they view the crafted content, potentially leading to session theft or unauthorized actions. The vulnerability affects versions up to and including 4.9.12.1 and requires user interaction (UI:R) combined with Contributor access (PR:L), with a CVSS 3.1 base score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.
Cross-site scripting (XSS) in the Virtue/Ascend/Pinnacle Toolkit WordPress plugin allows an authenticated Contributor-level user to inject malicious script that executes in a higher-privileged user's browser when they view the crafted content, potentially leading to session theft or unauthorized actions. The vulnerability affects versions up to and including 4.9.12.1 and requires user interaction (UI:R) combined with Contributor access (PR:L), with a CVSS 3.1 base score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.