CyberRota Analysis
AI-GeneratedThe 10Web Booster WordPress plugin prior to version 2.33.5 is vulnerable due to improper validation of access tokens and insufficient escaping of user-supplied stylesheet content. This flaw allows unauthenticated attackers to inject malicious JavaScript that executes in the browsers of anonymous visitors, potentially leading to cross-site scripting (XSS) attacks. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of exploitation.
Original NVD Description
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page.