CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BracketSpace Advanced Cron Manager – debug & control allows Stored XSS.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.2.
Explanation of Vulnerability in Simple Terms
Advanced Cron Manager contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.5.2. An authenticated administrator can inject malicious scripts that execute in the browsers of other users viewing the plugin's interface. The vulnerability requires user interaction—a victim must visit an affected page—and impacts confidentiality, integrity, and availability within the plugin's scope.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view the plugin interface.
Potential impact on your site
A compromised admin account can inject scripts affecting other administrators' sessions and data.
Conditions required to exploit
Administrator access to the site; victim must visit an affected plugin page.
Key dates
External resources
Related vulnerabilities
