Wp Tab Widget
Monthly
Stored Cross-Site Scripting in WP Tab Widget (WordPress plugin by MyThemeShop) allows authenticated contributors to inject persistent malicious scripts into tab widget content that execute in the browsers of other site users, including administrators. All versions up to and including 1.2.11 are confirmed affected per Patchstack and ENISA EUVD-2026-60930. The CVSS scope change metric (S:C) elevates the practical impact beyond the contributor's own session, enabling privilege escalation paths such as admin cookie theft. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in WP Tab Widget (WordPress plugin by MyThemeShop) allows authenticated contributors to inject persistent malicious scripts into tab widget content that execute in the browsers of other site users, including administrators. All versions up to and including 1.2.11 are confirmed affected per Patchstack and ENISA EUVD-2026-60930. The CVSS scope change metric (S:C) elevates the practical impact beyond the contributor's own session, enabling privilege escalation paths such as admin cookie theft. No public exploit identified at time of analysis.