Wp Quicklatex
Monthly
Unauthenticated stored cross-site scripting in WP QuickLaTeX for WordPress (versions <= 3.8.8) allows a remote unauthenticated attacker to inject malicious scripts into LaTeX-rendered content. When a privileged user such as a site administrator views the affected page, the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. Reported by Patchstack; no public exploit code or active exploitation confirmed at time of analysis.
The WP QuickLaTeX WordPress plugin before 3.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP QuickLaTeX WordPress plugin before 3.8.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated stored cross-site scripting in WP QuickLaTeX for WordPress (versions <= 3.8.8) allows a remote unauthenticated attacker to inject malicious scripts into LaTeX-rendered content. When a privileged user such as a site administrator views the affected page, the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. Reported by Patchstack; no public exploit code or active exploitation confirmed at time of analysis.
The WP QuickLaTeX WordPress plugin before 3.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP QuickLaTeX WordPress plugin before 3.8.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.