CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rami Yushuvaev Sketchfab Embed allows Stored XSS.This issue affects Sketchfab Embed: from n/a through 1.5.
Explanation of Vulnerability in Simple Terms
Sketchfab Embed versions up to 1.5 contain a cross-site scripting (XSS) vulnerability that allows an attacker with low-level access to inject malicious scripts. When a victim visits a page containing the malicious embed, the script executes in their browser with access to their session. The vulnerability requires user interaction and affects the integrity and confidentiality of site data.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers and steals session data or performs actions on their behalf.
Potential impact on your site
Visitors' sessions and data can be compromised if they view pages with malicious Sketchfab embeds.
Conditions required to exploit
Attacker needs low-level site access (e.g., contributor role) and victim must view the affected page.
Key dates
External resources
Related vulnerabilities
