CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1.
Explanation of Vulnerability in Simple Terms
Real Media Library versions 4.14.1 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other site users, including administrators. The vulnerability affects the scope beyond the vulnerable component, potentially compromising site security and user data.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they interact with the plugin.
Potential impact on your site
Authenticated attackers can steal admin sessions, modify site content, or harvest user data without additional clicks from victims.
Conditions required to exploit
Attacker must be logged in with low-level user privileges; no user interaction required from victims.
Key dates
External resources
Related vulnerabilities
