CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CeiKay Tooltip CK tooltip-ck allows Stored XSS.This issue affects Tooltip CK: from n/a through 2.2.15.
Explanation of Vulnerability in Simple Terms
Tooltip CK versions up to 2.2.15 contain a cross-site scripting (XSS) vulnerability that allows high-privilege users to inject malicious scripts. The vulnerability requires user interaction and affects the scope beyond the vulnerable component. An attacker with administrative or editor-level access can craft a tooltip that executes JavaScript in other users' browsers, potentially compromising site security or user data.
What an attacker can do
Inject JavaScript code that runs in other users' browsers when they view a tooltip.
Potential impact on your site
A compromised admin or editor account can inject malicious scripts affecting all site visitors who view tooltips.
Conditions required to exploit
Attacker must have high-level site privileges (admin or editor role) and the victim must view the affected tooltip.
Key dates
External resources
Related vulnerabilities
