CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Garrett Grimm Simple Popup allows Stored XSS.This issue affects Simple Popup: from n/a through 4.4.
Explanation of Vulnerability in Simple Terms
Simple Popup versions 4.4 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. An attacker with admin privileges can craft a popup configuration that executes JavaScript in the browsers of site visitors. The vulnerability requires user interaction and affects the integrity and confidentiality of visitor data.
What an attacker can do
Inject JavaScript code that runs in visitors' browsers when they view a popup.
Potential impact on your site
A compromised admin account can inject malicious scripts affecting all site visitors who see popups.
Conditions required to exploit
Attacker must have administrator privileges and trick an admin into viewing a malicious popup configuration.
Key dates
External resources
Related vulnerabilities
