Description

Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T14:17:03.133Z",
  "pubdate": "2026-08-18T14:17:03.133Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the Mayosis Core plugin in versions 5.4.7 and prior. This security flaw allows unauthenticated remote attackers to inject malicious client-side scripts, typically JavaScript, into web pages rendered to legitimate users visiting the affected WordPress site. The root cause stems from insufficient sanitization and output encoding of user-supplied input parameters handled by the vulnerable component. Consequently, successful exploitation requires no authentication or specialized privileges, lowering the attack barrier significantly. When an authenticated user, such as an administrator, or an ordinary visitor interacts with the maliciously crafted URL or payload, the injected script executes within the context of their browser session. The potential impact encompasses the hijacking of user sessions, theft of sensitive authentication cookies, redirection of users to malicious external sites, and unauthorized actions performed on behalf of the victim. If an administrative user falls victim to the exploit, attackers can achieve full site compromise by creating new administrative accounts, modifying core configurations, or injecting persistent malware into the hosting environment. Organizations utilizing Mayosis Core versions 5.4.7 or earlier face significant risk exposure due to the unauthenticated nature of the flaw.",
  "technicalDetails": "The vulnerability is classified as an unauthenticated Cross-Site Scripting (XSS) flaw affecting Mayosis Core <= 5.4.7. The vulnerability manifests because the application accepts input parameters via HTTP requests without implementing proper input sanitization, validation, or contextual output encoding before reflecting the data back in the Document Object Model (DOM).\nNetwork Exposure: The vulnerable endpoints are exposed over the public network via standard HTTP/HTTPS protocols, allowing any remote unauthenticated actor to interact with the application and transmit malicious payloads.\nAuthentication and Privilege Requirements: The exploitation vector requires zero authentication and no prior privileges. An attacker does not need valid user credentials to initiate the attack sequence.\nAttack Flow and Step-by-Step Exploitation: 1. The attacker crafts a malicious HTTP GET or POST request containing a payload consisting of HTML and JavaScript tags targeting an unvalidated input parameter handled by the Mayosis Core codebase. 2. The attacker induces a target user or victim to click a specially crafted URL containing this payload. 3. The server processes the request and improperly reflects the unsanitized input within the HTTP response body without applying robust output encoding mechanisms such as HTML entity encoding. 4. The victim's browser parses the HTTP response, interprets the injected script tags as executable code rather than plain text, and executes the script within the security context of the victim's active session.\nPayload Behavior: The executed payload operates within the Document Object Model (DOM) of the victim's browser session. It possesses access to sensitive client-side data, including document.cookie, session storage, local storage, and the ability to execute asynchronous XMLHttpRequest (XHR) or Fetch API calls to perform unauthorized actions on the vulnerable web application.\nPost-Exploitation Impact: Depending on the privileges of the user targeted by the exploit, the post-exploitation impact ranges from session hijacking and credential theft to arbitrary modification of web content. If the victim is a privileged administrator, the attacker can leverage the XSS payload to inject persistent backdoors, create rogue administrative accounts, or execute arbitrary administrative functions within the WordPress environment."
}