Wp Meteor Website Speed Optimization Addon
Monthly
Stored Cross-Site Scripting in WP Meteor Website Speed Optimization Addon for WordPress (all versions through 3.4.16) allows unauthenticated attackers to permanently inject arbitrary JavaScript into pages via the WPMETEOR[N]WPMETEOR placeholder processed by the frontend_rewrite function. The injected script executes in the browser of any user who subsequently visits the compromised page, enabling session hijacking, credential theft, or malicious redirects. No active exploitation is confirmed (SSVC: none; EPSS 0.07%, 21st percentile), though unauthenticated stored XSS with a scope change carries meaningful real-world risk on publicly accessible WordPress sites.
Stored Cross-Site Scripting in WP Meteor Website Speed Optimization Addon for WordPress (all versions through 3.4.16) allows unauthenticated attackers to permanently inject arbitrary JavaScript into pages via the WPMETEOR[N]WPMETEOR placeholder processed by the frontend_rewrite function. The injected script executes in the browser of any user who subsequently visits the compromised page, enabling session hijacking, credential theft, or malicious redirects. No active exploitation is confirmed (SSVC: none; EPSS 0.07%, 21st percentile), though unauthenticated stored XSS with a scope change carries meaningful real-world risk on publicly accessible WordPress sites.