What the vulnerability does
01Description
A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic. Affected by this vulnerability is the function embed_handler of the file beelikedmicrosite.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is d23bafb5d05fb2636a2b78331f9d3fca152903dc. It is recommended to upgrade the affected component. The identifier VDB-233365 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Beeliked Microsite Plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the site. An attacker with low-level account access can craft input that executes JavaScript in other users' browsers when they view affected pages. This can lead to session hijacking, credential theft, or defacement.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in other users' browsers when they view the affected page.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other site visitors; restrict plugin access to trusted administrators only.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site and the victim must visit a page containing the injected payload.
Key dates
06Disclosure timeline
July 10, 2023
CVE published
November 21, 2024
Record updated
