CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored XSS.This issue affects Crypto Converter Widget: from n/a through 1.8.4.
Explanation of Vulnerability in Simple Terms
The Crypto Converter Widget contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. When a victim visits a page containing the widget, the injected code executes in their browser with access to their session. The vulnerability requires user interaction and affects confidentiality, integrity, and availability of the affected site.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers and steals session data or performs actions on their behalf.
Potential impact on your site
Visitors' accounts and data are at risk if an authenticated user injects malicious code into the widget.
Conditions required to exploit
Attacker needs a low-privilege account on the site; victim must view a page with the malicious widget content.
Key dates
External resources
Related vulnerabilities
