CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Optemiz XPlainer - WooCommerce Product FAQ allows Reflected XSS.This issue affects XPlainer - WooCommerce Product FAQ: from n/a through 1.6.3.
Explanation of Vulnerability in Simple Terms
XPlainer - WooCommerce Product FAQ versions up to 1.6.3 contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in visitors' browsers when they view affected pages. The attack requires user interaction and network access but no authentication. Impact is limited to session hijacking, credential theft, or malware distribution to site visitors.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers to steal data or redirect them.
Potential impact on your site
Visitors may have sessions hijacked, credentials stolen, or be redirected to malicious sites.
Conditions required to exploit
Visitor must view a page containing the injected payload; attacker needs network access.
Key dates
External resources
Related vulnerabilities
