Zeinet
Monthly
Reflected cross-site scripting in the Bracketweb Zeinet WordPress theme (all versions through 1.0.0) allows an unauthenticated remote attacker to inject script that executes in the browser of a victim who clicks a crafted link. Because attacker-supplied input is reflected into the generated page without neutralization (CWE-79, CVSS 7.1), the injected script runs in the origin of the affected site and can steal session cookies, perform actions as the victim, or operate with administrative privileges if the clicking victim is a logged-in admin. The flaw has not been confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis; exploitation hinges on user interaction (CVSS UI:R), which is the primary limiting factor.
Reflected cross-site scripting in the Bracketweb Zeinet WordPress theme (all versions through 1.0.0) allows an unauthenticated remote attacker to inject script that executes in the browser of a victim who clicks a crafted link. Because attacker-supplied input is reflected into the generated page without neutralization (CWE-79, CVSS 7.1), the injected script runs in the origin of the affected site and can steal session cookies, perform actions as the victim, or operate with administrative privileges if the clicking victim is a logged-in admin. The flaw has not been confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis; exploitation hinges on user interaction (CVSS UI:R), which is the primary limiting factor.