CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the plugin which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.4.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Explanation of Vulnerability in Simple Terms
Business Manager versions 1.4.5 contain a cross-site scripting (XSS) vulnerability that allows high-privilege users to inject malicious scripts affecting other users or the site. The vulnerability has limited scope but can compromise data integrity and expose sensitive information. An administrator account is required to exploit this issue.
What an attacker can do
Inject malicious scripts that execute in other users' browsers and modify site content or steal session data.
Potential impact on your site
A compromised admin account can inject scripts affecting other users; data integrity and user sessions at risk.
Conditions required to exploit
Attacker must have high-level administrative privileges and network access to the application.
Key dates
External resources
Related vulnerabilities
