Wavr
Monthly
Stored Cross-Site Scripting in Wavr WordPress plugin up to version 0.2.6 allows authenticated contributors and above to inject arbitrary JavaScript via insufficiently sanitized shortcode attributes, with malicious scripts executing for all users who view affected pages. CVSS 6.4 reflects moderate severity with network-accessible attack vector and cross-site impact; no public exploit code or active exploitation confirmed at time of analysis.
Stored Cross-Site Scripting in Wavr WordPress plugin up to version 0.2.6 allows authenticated contributors and above to inject arbitrary JavaScript via insufficiently sanitized shortcode attributes, with malicious scripts executing for all users who view affected pages. CVSS 6.4 reflects moderate severity with network-accessible attack vector and cross-site impact; no public exploit code or active exploitation confirmed at time of analysis.