Wp Associate Post R2
Monthly
Reflected cross-site scripting in WP Associate Post R2 versions up to 5.0.1 allows remote, unauthenticated attackers to inject arbitrary script into a page via a crafted URL, requiring the victim to click a malicious link (UI:R). This moderate-severity (CVSS 7.1) flaw affects the WordPress plugin by Delight Star Inc., and no public exploit or active exploitation has been identified at time of analysis. The scope-changed impact is limited to the victim's browser session, but privileged users such as administrators are at higher risk if lured.
Reflected cross-site scripting in WP Associate Post R2 versions up to 5.0.1 allows remote, unauthenticated attackers to inject arbitrary script into a page via a crafted URL, requiring the victim to click a malicious link (UI:R). This moderate-severity (CVSS 7.1) flaw affects the WordPress plugin by Delight Star Inc., and no public exploit or active exploitation has been identified at time of analysis. The scope-changed impact is limited to the victim's browser session, but privileged users such as administrators are at higher risk if lured.