CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through 1.0.11.
Explanation of Vulnerability in Simple Terms
Keap Official Opt-in Forms versions up to 1.0.11 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts into form fields. When other users view the affected form or data, the injected script executes in their browser, potentially allowing the attacker to steal session tokens, redirect users, or perform actions on their behalf.
What an attacker can do
Inject malicious scripts that execute when other users view the form or stored data.
Potential impact on your site
Users' sessions and data are at risk if attackers inject scripts into forms; site admins should restrict form access and update immediately.
Conditions required to exploit
Attacker must have a low-privilege account and the victim must view the page containing the injected script.
Key dates
External resources
Related vulnerabilities
