CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 1.1.29.
Explanation of Vulnerability in Simple Terms
Popup Builder versions up to 1.1.29 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts into popup content. When other users view the affected popups, the scripts execute in their browsers, potentially compromising their sessions or stealing data. The vulnerability requires user interaction to trigger.
What an attacker can do
Inject malicious scripts that execute when other users view popups, potentially stealing session data or performing actions on their behalf.
Potential impact on your site
Authenticated users with low privileges can compromise other users' accounts or sessions through popup content injection.
Conditions required to exploit
Attacker must have low-level authenticated access to the site and a victim must view the affected popup.
Key dates
External resources
Related vulnerabilities
