CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Soliloquy Lite 2.5.6 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by inserting script tags in the post title field. Attackers can submit POST requests to the post editing endpoint with script payloads in the post_title parameter, which are stored and executed when users preview the post.
Explanation of Vulnerability in Simple Terms
Soliloquy Lite contains a cross-site scripting (XSS) vulnerability in version 2.5.6 and earlier. An attacker with low-level access can inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction to trigger. Update to a version newer than 2.5.6 to remediate.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they visit affected pages.
Potential impact on your site
Users' sessions could be hijacked, credentials stolen, or site content defaced through injected scripts.
Conditions required to exploit
Attacker needs low-level site access; victim must click a link or visit a page containing the payload.
Key dates
External resources
Related vulnerabilities
