CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Web357 Easy Custom Code (LESS/CSS/JS) – Live editing allows Stored XSS.This issue affects Easy Custom Code (LESS/CSS/JS) – Live editing: from n/a through 1.0.8.
Explanation of Vulnerability in Simple Terms
Easy Custom Code allows authenticated users with high privileges to inject malicious scripts into live-edited CSS, LESS, or JavaScript code. When another user views a page containing the injected code, the script executes in their browser. The vulnerability requires an admin or high-privilege user to craft the injection and a victim to interact with the affected page.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they view edited code.
Potential impact on your site
A compromised admin account can inject scripts affecting other users' sessions and data.
Conditions required to exploit
Attacker must have high-privilege admin access; victim must view a page with the injected code.
Key dates
External resources
Related vulnerabilities
