| Package | Affected versions | Patched versions |
|---|---|---|
| wp-js | ≤ 2.0.6 |
The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free