Wpcs
Monthly
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.