CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HashBar – WordPress Notification Bar allows Stored XSS.This issue affects HashBar – WordPress Notification Bar: from n/a through 1.4.1.
Explanation of Vulnerability in Simple Terms
HashBar contains a stored cross-site scripting (XSS) vulnerability in notification bar settings. An authenticated admin with high privileges can inject malicious scripts that execute in the browsers of site visitors. The vulnerability requires admin interaction to inject the payload and affects the scope beyond the plugin itself. Low-level data exposure and site defacement are possible.
What an attacker can do
Inject malicious scripts that run in visitors' browsers, potentially stealing data or redirecting users.
Potential impact on your site
A compromised admin account can inject scripts affecting all site visitors, leading to data theft or malware distribution.
Conditions required to exploit
Admin-level access to the site and user interaction to save a malicious notification bar configuration.
Key dates
External resources
Related vulnerabilities
