CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in pluginever WP Content Pilot – Autoblogging & Affiliate Marketing Plugin allows Code Injection.This issue affects WP Content Pilot – Autoblogging & Affiliate Marketing Plugin: from n/a through 1.3.3.
Explanation of Vulnerability in Simple Terms
WP Content Pilot versions up to 1.3.3 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into site content. An attacker with low-level WordPress access can craft input that executes in other users' browsers, potentially compromising site functionality or stealing session data. The vulnerability requires an authenticated account but no additional user interaction.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they view affected content.
Potential impact on your site
Authenticated users with low privileges can inject scripts affecting site visitors and administrators, risking data theft or malware distribution.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., contributor or subscriber role).
Key dates
External resources
Related vulnerabilities
