CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style attributes in all versions up to, and including, 4.22.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Explanation of Vulnerability in Simple Terms
Real Media Library versions up to 4.22.7 contain an input validation flaw that allows authenticated users with low privileges to read sensitive information or modify data across the site. The vulnerability stems from insufficient input validation (CWE-20) and affects the scope beyond the vulnerable component. Site administrators should update to a version newer than 4.22.7 to remediate the issue.
What an attacker can do
Read sensitive data or modify content on the site with low-level user privileges.
Potential impact on your site
Authenticated users can access or alter data they should not have permission to view or modify.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
