Wp Discussion Board
Monthly
Stored cross-site scripting in the WP Discussion Board WordPress plugin, affecting versions through 2.6.0, allows an authenticated low-privilege user to persist script content that executes in the browser of any victim who later views it (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The attacker must hold at least a low-privileged account able to submit content the plugin stores, and impact requires a separate victim to load that content; the payload remains server-side and re-triggers for each viewer until the stored data is cleaned or the plugin is fixed. Reported by Patchstack and rated 'this_month' priority rather than an urgent label, this issue has no public exploit identified at time of analysis and no CISA KEV listing.
WP Discussion Board, a WordPress plugin, fails to enforce an authorization check on one of its functions in versions up to and including 2.6.0, letting remote visitors reach data or actions that should have been restricted by access-control configuration. The assessed vector (CVSS 5.3, AV:N/AC:L/PR:N/UI:N) means the flaw is exploitable over the network without credentials or user interaction against a default-exposed WordPress site, but the impact is bounded to low confidentiality exposure (C:L, I:N, A:N) rather than data modification or code execution. No public exploit code is identified at time of analysis, there is no CISA KEV listing, and the priority label is 'this_month'; the exact vulnerable endpoint, parameter or plugin configuration that triggers the missing check is not described in the available sources.
Stored cross-site scripting in the WP Discussion Board WordPress plugin, affecting versions through 2.6.0, allows an authenticated low-privilege user to persist script content that executes in the browser of any victim who later views it (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The attacker must hold at least a low-privileged account able to submit content the plugin stores, and impact requires a separate victim to load that content; the payload remains server-side and re-triggers for each viewer until the stored data is cleaned or the plugin is fixed. Reported by Patchstack and rated 'this_month' priority rather than an urgent label, this issue has no public exploit identified at time of analysis and no CISA KEV listing.
WP Discussion Board, a WordPress plugin, fails to enforce an authorization check on one of its functions in versions up to and including 2.6.0, letting remote visitors reach data or actions that should have been restricted by access-control configuration. The assessed vector (CVSS 5.3, AV:N/AC:L/PR:N/UI:N) means the flaw is exploitable over the network without credentials or user interaction against a default-exposed WordPress site, but the impact is bounded to low confidentiality exposure (C:L, I:N, A:N) rather than data modification or code execution. No public exploit code is identified at time of analysis, there is no CISA KEV listing, and the priority label is 'this_month'; the exact vulnerable endpoint, parameter or plugin configuration that triggers the missing check is not described in the available sources.