Wordpress Persistent Login
Monthly
Unauthenticated cross-site scripting in the WordPress Persistent Login plugin (author lukeseager) at versions 3.1.3 and earlier allows a remote attacker to execute arbitrary script in a victim's browser by luring them into loading attacker-influenced content that reaches the vulnerable sink; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) exploitation needs victim interaction but no authentication. The issue is rated High at 7.1, with scope change and low impact to confidentiality, integrity and availability confined to the victim's browser session, and the exact vulnerable parameter is not detailed in the advisory data. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (no CISA KEV listing); no EPSS score was supplied.
SQL injection in WordPress Persistent Login plugin (versions 3.1.0 and earlier) can be triggered by a subscriber-level authenticated user, allowing extraction of sensitive database records including user credentials and site configuration data. The vulnerability carries a scope change in the CVSS assessment (S:C), indicating that injected queries can reach database content beyond the plugin's immediate context. No public exploit or CISA KEV listing has been identified at the time of this analysis, but the low attack complexity and wide deployment of WordPress as a platform make this a meaningful risk for any site running this plugin.
Unauthenticated cross-site scripting in the WordPress Persistent Login plugin (author lukeseager) at versions 3.1.3 and earlier allows a remote attacker to execute arbitrary script in a victim's browser by luring them into loading attacker-influenced content that reaches the vulnerable sink; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) exploitation needs victim interaction but no authentication. The issue is rated High at 7.1, with scope change and low impact to confidentiality, integrity and availability confined to the victim's browser session, and the exact vulnerable parameter is not detailed in the advisory data. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (no CISA KEV listing); no EPSS score was supplied.
SQL injection in WordPress Persistent Login plugin (versions 3.1.0 and earlier) can be triggered by a subscriber-level authenticated user, allowing extraction of sensitive database records including user credentials and site configuration data. The vulnerability carries a scope change in the CVSS assessment (S:C), indicating that injected queries can reach database content beyond the plugin's immediate context. No public exploit or CISA KEV listing has been identified at the time of this analysis, but the low attack complexity and wide deployment of WordPress as a platform make this a meaningful risk for any site running this plugin.