CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Media Alt Renamer allows Stored XSS.This issue affects Media Alt Renamer: from n/a through 0.0.1.
Explanation of Vulnerability in Simple Terms
Media Alt Renamer versions up to 0.0.1 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator with high privileges can inject malicious scripts into media alt text fields. When another user views the affected content, the script executes in their browser, potentially allowing session hijacking or credential theft.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they view media alt text.
Potential impact on your site
Administrators can be tricked into running attacker code, compromising site security and user data.
Conditions required to exploit
Attacker must be an authenticated administrator; victim must visit a page displaying the injected alt text.
Key dates
External resources
Related vulnerabilities
