Webberzone Top 10 Popular Posts
Monthly
Stored cross-site scripting (XSS) in the WebberZone Top 10 - Popular Posts WordPress plugin, a moderate-severity issue (CVSS 6.4), affects all versions up to and including 4.5.2 and allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts via crafted block JSON. The attacker sets an undeclared is_widget flag to '1' and supplies a malicious instance_id value that is concatenated into an unescaped HTML class attribute, so the payload executes when a victim-potentially an administrator-views the injected page. No public exploit code has been identified at the time of analysis, and exploitation requires a WordPress site that permits contributor-level or higher accounts and a non-default block configuration.
Stored cross-site scripting (XSS) in the WebberZone Top 10 - Popular Posts WordPress plugin, a moderate-severity issue (CVSS 6.4), affects all versions up to and including 4.5.2 and allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts via crafted block JSON. The attacker sets an undeclared is_widget flag to '1' and supplies a malicious instance_id value that is concatenated into an unescaped HTML class attribute, so the payload executes when a victim-potentially an administrator-views the injected page. No public exploit code has been identified at the time of analysis, and exploitation requires a WordPress site that permits contributor-level or higher accounts and a non-default block configuration.