Wp Real Ip Based Access Control
Monthly
Stored cross-site scripting in the WP Real IP-based Access Control WordPress plugin (all versions through 1.3.1) allows unauthenticated remote attackers to inject persistent JavaScript into the plugin's settings page, which executes in the browser of any administrator who subsequently views that page. The root cause is a complete absence of capability checks and nonce validation on the option-storing endpoint, combined with unescaped output rendering on the settings page. A publicly available proof-of-concept exploit exists per WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog and carries a low EPSS score of 0.19% (9th percentile), suggesting no confirmed widespread exploitation at time of analysis.
Stored cross-site scripting in the WP Real IP-based Access Control WordPress plugin (all versions through 1.3.1) allows unauthenticated remote attackers to inject persistent JavaScript into the plugin's settings page, which executes in the browser of any administrator who subsequently views that page. The root cause is a complete absence of capability checks and nonce validation on the option-storing endpoint, combined with unescaped output rendering on the settings page. A publicly available proof-of-concept exploit exists per WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog and carries a low EPSS score of 0.19% (9th percentile), suggesting no confirmed widespread exploitation at time of analysis.