CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt OWL Carousel – WordPress Owl Carousel Slider allows Stored XSS.This issue affects OWL Carousel – WordPress Owl Carousel Slider: from n/a through 1.4.0.
Explanation of Vulnerability in Simple Terms
The OWL Carousel WordPress plugin through version 1.4.0 contains a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts into carousel settings. When other users view pages containing the carousel, the injected code executes in their browsers, potentially allowing session hijacking or credential theft.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they view carousel content.
Potential impact on your site
Authenticated users can inject scripts affecting all site visitors, risking account compromise and data theft.
Conditions required to exploit
Attacker must have a WordPress user account with low-level permissions and the victim must view a page with the affected carousel.
Key dates
External resources
Related vulnerabilities
