CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject script payloads through the testimonial title field that execute in the browsers of other users viewing the draft post, enabling cookie theft and session hijacking.
Explanation of Vulnerability in Simple Terms
Netroics Blog Posts Grid contains a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction, such as visiting a crafted link. An attacker with low-level privileges can inject code that affects other users viewing the same content.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they view affected content.
Potential impact on your site
Authenticated users with low privileges can inject scripts affecting other site visitors, potentially stealing session data or modifying page content.
Conditions required to exploit
Attacker must have low-level site access and the victim must visit a page containing the injected payload.
Key dates
External resources
Related vulnerabilities
