CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.
Explanation of Vulnerability in Simple Terms
The Floating Social Media Icon WordPress plugin through version 4.3.5 contains a stored cross-site scripting (XSS) vulnerability. An authenticated admin can inject malicious JavaScript through plugin settings that executes in the browsers of site visitors. The vulnerability requires admin privileges and user interaction to exploit, but can affect the site's integrity and visitor security.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers when they view the site.
Potential impact on your site
A compromised admin account can inject malware or steal visitor data without your knowledge.
Conditions required to exploit
Admin-level access to the WordPress site; victim must visit a page displaying the affected plugin.
Key dates
External resources
Related vulnerabilities
