CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UnitedThemes Shortcodes by United Themes allows Reflected XSS.This issue affects Shortcodes by United Themes: from n/a before 5.0.5.
Explanation of Vulnerability in Simple Terms
Shortcodes by United Themes versions before 5.0.5 contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in the browsers of site visitors. The vulnerability requires user interaction—typically clicking a crafted link—and can affect multiple users across the site. Update to version 5.0.5 or later to patch this issue.
What an attacker can do
Inject malicious scripts that run in visitors' browsers, stealing cookies, session tokens, or redirecting users.
Potential impact on your site
Visitors' browsers can be compromised; their session data or credentials may be stolen without your knowledge.
Conditions required to exploit
No authentication required. Attacker must trick a site visitor into clicking a malicious link or visiting a crafted page.
Key dates
External resources
Related vulnerabilities
