CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Tab Manager yith-woocommerce-tab-manager.This issue affects YITH WooCommerce Tab Manager: from n/a through <= 1.35.0.
Explanation of Vulnerability in Simple Terms
YITH WooCommerce Tab Manager versions up to 1.35.0 contain a stored cross-site scripting (XSS) vulnerability. An authenticated admin can inject malicious scripts into tab content that execute in the browsers of other users viewing the site. The vulnerability requires admin privileges and user interaction to exploit, but can affect site visitors and other administrators.
What an attacker can do
Inject malicious scripts that run in visitors' browsers when they view affected tabs.
Potential impact on your site
A compromised admin account can inject malware or steal visitor data through tab content.
Conditions required to exploit
Admin-level access to the site and a user must view the page containing the injected tab.
Key dates
External resources
Related vulnerabilities
