CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Supsystic Pricing Table by Supsystic allows Code Injection.This issue affects Pricing Table by Supsystic: from n/a through 1.9.12.
Explanation of Vulnerability in Simple Terms
Pricing Table by Supsystic versions up to 1.9.12 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts into pricing table data. These scripts execute in the browsers of other site visitors, potentially compromising their sessions or stealing sensitive information. The vulnerability requires an attacker to have a user account on the site.
What an attacker can do
Inject malicious scripts that execute when other users view pricing tables on the site.
Potential impact on your site
Visitors to pages with pricing tables may have their sessions hijacked or credentials stolen by injected malicious code.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required from victims.
Key dates
External resources
Related vulnerabilities
