CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SubscriptionPro WP Announcement allows Stored XSS.This issue affects WP Announcement: from n/a through 2.0.8.
Explanation of Vulnerability in Simple Terms
WP Announcement versions up to 2.0.8 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts into announcement content that execute in other users' browsers when they view the announcement. The vulnerability requires administrator privileges and user interaction to exploit, but can affect site visitors across the platform.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view announcements.
Potential impact on your site
Site visitors could have their sessions hijacked or credentials stolen if an admin account is compromised.
Conditions required to exploit
Administrator account access and victim must view the affected announcement.
Key dates
External resources
Related vulnerabilities
