CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L
What the vulnerability does
Multiple Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerabilities in Adam Skaat's Countdown & Clock plugin <= 2.3.2 at WordPress via &ycd-countdown-width, &ycd-progress-height, &ycd-progress-width, &ycd-button-margin-top, &ycd-button-margin-right, &ycd-button-margin-bottom, &ycd-button-margin-left, &ycd-circle-countdown-before-countdown, &ycd-circle-countdown-after-countdown vulnerable parameters.
Explanation of Vulnerability in Simple Terms
The Countdown & Clock WordPress plugin through version 2.3.2 contains a stored cross-site scripting (XSS) vulnerability in its settings. An authenticated admin can inject malicious scripts that execute when other users view the plugin's pages. The vulnerability requires admin privileges and user interaction to exploit, but affects the integrity of the site and can impact availability.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view affected plugin pages.
Potential impact on your site
A compromised admin account can inject scripts affecting site visitors and potentially disrupt plugin functionality.
Conditions required to exploit
Admin-level access to the WordPress site; victim must visit a page containing the injected content.
Key dates
External resources
Related vulnerabilities
