CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack.
Explanation of Vulnerability in Simple Terms
The Breeze WordPress plugin version 2.0.2 and earlier contains a permissions flaw that allows authenticated users with low privileges to perform actions they should not be able to. An attacker must be logged in and trick a site administrator into clicking a malicious link. The vulnerability can leak sensitive data, modify site content, or disrupt service availability.
What an attacker can do
Read sensitive data, modify site content, or disrupt availability if logged in and victim clicks a link.
Potential impact on your site
Authenticated attackers can bypass permission checks to access or modify data they shouldn't reach.
Conditions required to exploit
Attacker must have a low-privilege account and the site admin must click a malicious link.
Key dates
External resources
Related vulnerabilities
