CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pratik Chaskar Cards for Beaver Builder.This issue affects Cards for Beaver Builder: from n/a through 1.1.4.
Explanation of Vulnerability in Simple Terms
Cards for Beaver Builder versions up to 1.1.4 contain a cross-site scripting vulnerability in card content rendering. An authenticated user with high privileges can inject malicious scripts that execute in other users' browsers when they view affected pages. The vulnerability requires user interaction and can affect site visitors across different contexts.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view card content.
Potential impact on your site
Compromised admin accounts could inject persistent scripts affecting all site visitors, potentially stealing credentials or redirecting users.
Conditions required to exploit
Attacker must have high-level admin privileges and the victim must visit a page containing the malicious card.
Key dates
External resources
Related vulnerabilities
