CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic Slider by Supsystic allows Stored XSS.This issue affects Slider by Supsystic: from n/a through 1.8.10.
Explanation of Vulnerability in Simple Terms
Slider by Supsystic versions up to 1.8.10 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious JavaScript into slider content that executes in the browsers of site visitors. The vulnerability requires an admin to craft a malicious slider and a user to view the affected page. This can lead to session hijacking, credential theft, or malware distribution to site visitors.
What an attacker can do
Inject JavaScript code that runs in visitors' browsers when they view a slider.
Potential impact on your site
Visitors' sessions and credentials can be compromised if an admin account is breached or malicious.
Conditions required to exploit
Attacker must have administrator privileges and a visitor must view the page containing the malicious slider.
Key dates
External resources
Related vulnerabilities
