Wpcomplete
Monthly
Stored cross-site scripting can be planted on WordPress sites running the WPComplete plugin through version 2.9.5.6, because a WPComplete write action is performed without adequate CSRF nonce validation (CWE-352) and the stored value is later rendered without sufficient output encoding. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) the attacker needs no credentials of their own, but exploitation requires tricking a logged-in, privileged WordPress user into visiting an attacker-controlled page or link while their session is active, which is the primary limiting factor. No public exploit code or confirmed active exploitation was identified at time of analysis, and the net effect is a moderate-priority risk: injected script executes in the site context (scope changed) and can affect other users, but impact to confidentiality, integrity, and availability is each rated Low.
Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the premium (pro) edition of the WPComplete WordPress plugin, affecting all versions up to and including 2.9.9.0, lets an authenticated user with contributor-level access or above inject arbitrary script into the 'empty' shortcode attribute; the payload persists in page content and executes in the browser of anyone who later views that page. The free version of the plugin is not affected, and exploitation requires the paid edition to be installed and active, which materially narrows the exposed population. There is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); this is assessed as a moderate, not urgent, priority given the pro-only scope and the prerequisite of an authenticated contributor account.
Stored cross-site scripting can be planted on WordPress sites running the WPComplete plugin through version 2.9.5.6, because a WPComplete write action is performed without adequate CSRF nonce validation (CWE-352) and the stored value is later rendered without sufficient output encoding. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) the attacker needs no credentials of their own, but exploitation requires tricking a logged-in, privileged WordPress user into visiting an attacker-controlled page or link while their session is active, which is the primary limiting factor. No public exploit code or confirmed active exploitation was identified at time of analysis, and the net effect is a moderate-priority risk: injected script executes in the site context (scope changed) and can affect other users, but impact to confidentiality, integrity, and availability is each rated Low.
Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the premium (pro) edition of the WPComplete WordPress plugin, affecting all versions up to and including 2.9.9.0, lets an authenticated user with contributor-level access or above inject arbitrary script into the 'empty' shortcode attribute; the payload persists in page content and executes in the browser of anyone who later views that page. The free version of the plugin is not affected, and exploitation requires the paid edition to be installed and active, which materially narrows the exposed population. There is no public exploit code identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); this is assessed as a moderate, not urgent, priority given the pro-only scope and the prerequisite of an authenticated contributor account.