CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webstix Admin Dashboard RSS Feed allows Stored XSS.This issue affects Admin Dashboard RSS Feed: from n/a through 3.1.
Explanation of Vulnerability in Simple Terms
The Admin Dashboard RSS Feed contains a cross-site scripting (XSS) vulnerability in versions 3.1 and earlier. An attacker with high-level privileges can inject malicious scripts into RSS feed content. When another admin views the feed, the script executes in their browser, potentially allowing the attacker to steal session tokens or perform actions on their behalf. A victim admin must view the affected feed for the attack to succeed.
What an attacker can do
Inject malicious scripts that execute when other admins view RSS feed content in their browser.
Potential impact on your site
Admins viewing RSS feeds risk session hijacking or unauthorized actions performed in their accounts.
Conditions required to exploit
High-level admin privileges and the victim must view the compromised RSS feed.
Key dates
External resources
Related vulnerabilities
