CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Currency.Wiki Currency Converter Widget – Exchange Rates allows Stored XSS.This issue affects Currency Converter Widget – Exchange Rates: from n/a through 3.0.2.
Explanation of Vulnerability in Simple Terms
The Currency Converter Widget for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 3.0.2. An authenticated user with low privileges can inject malicious JavaScript that executes in the browsers of other site visitors, potentially compromising their sessions or stealing sensitive data. The vulnerability requires user interaction and affects the entire site scope.
What an attacker can do
Inject JavaScript that runs in other users' browsers when they view the affected widget.
Potential impact on your site
Visitors' sessions and data can be compromised; site reputation and user trust are at risk.
Conditions required to exploit
Attacker must have a low-privilege WordPress account and trick a site admin or user into viewing a page with the malicious widget.
Key dates
External resources
Related vulnerabilities
