CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify - Buddypress Moderation.This issue affects Youzify - Buddypress Moderation: from n/a through 1.2.5.
Explanation of Vulnerability in Simple Terms
Youzify - Buddypress Moderation versions up to 1.2.5 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the site without authentication. An attacker can craft a malicious request to inject JavaScript that executes in users' browsers, potentially stealing session tokens or performing actions on their behalf. Site administrators should update to a version newer than 1.2.5 immediately.
What an attacker can do
Inject malicious JavaScript that runs in users' browsers and steals data or performs unauthorized actions.
Potential impact on your site
Visitors and members may have their sessions hijacked, credentials stolen, or be redirected to malicious sites.
Conditions required to exploit
No authentication or user interaction required; attacker can exploit this remotely over the network.
Key dates
External resources
Related vulnerabilities
