CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a through 1.3.6.
Explanation of Vulnerability in Simple Terms
WP Directory Kit versions up to 1.3.6 contain an input validation flaw that allows high-privilege users to modify data they should not be able to change. The vulnerability requires administrator-level access and does not affect confidentiality or availability. A patch version has not been publicly identified.
What an attacker can do
Modify data within the plugin if they have administrator access.
Potential impact on your site
Administrators with malicious intent or compromised admin accounts could alter plugin data; non-admin users are unaffected.
Conditions required to exploit
Attacker must have administrator-level privileges on the WordPress site.
Key dates
External resources
Related vulnerabilities
