CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pascal Birchler Preferred Languages allows DOM-Based XSS.This issue affects Preferred Languages: from n/a through 2.2.2.
Explanation of Vulnerability in Simple Terms
Preferred Languages versions up to 2.2.2 contain a cross-site scripting vulnerability that allows high-privilege users to inject malicious scripts. The vulnerability requires user interaction and affects the integrity and confidentiality of site data. An attacker with administrative access can craft a malicious request that, when clicked by another user, executes JavaScript in their browser.
What an attacker can do
Inject and execute malicious JavaScript in other users' browsers to steal data or perform actions on their behalf.
Potential impact on your site
An admin-level attacker can compromise other users' sessions or steal sensitive information through JavaScript execution.
Conditions required to exploit
Attacker must have high-level site privileges (e.g., admin or editor role) and trick another user into clicking a malicious link.
Key dates
External resources
Related vulnerabilities
