CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aluka BA Plus – Before & After Image Slider FREE allows Reflected XSS.This issue affects BA Plus – Before & After Image Slider FREE: from n/a through 1.0.3.
Explanation of Vulnerability in Simple Terms
The BA Plus – Before & After Image Slider FREE plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.0.3. An attacker can inject malicious JavaScript that executes in the browsers of site visitors. The vulnerability requires user interaction to trigger and can affect other users on the site. Update the plugin to a version newer than 1.0.3.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers and steals data or performs actions on their behalf.
Potential impact on your site
Visitors' browsers could be compromised; attackers could steal session tokens, redirect users, or deface content.
Conditions required to exploit
No authentication required. A site visitor must view a page containing the injected malicious content.
Key dates
External resources
Related vulnerabilities
