CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS.This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0.
Explanation of Vulnerability in Simple Terms
Plum: Spin Wheel & Email Pop-up versions up to 2.0 lack proper authorization checks, allowing unauthenticated attackers to perform unauthorized actions over the network. The vulnerability affects confidentiality, integrity, and availability of the affected system. No authentication or user interaction is required to exploit this flaw.
What an attacker can do
Perform unauthorized actions without logging in, potentially reading data, modifying content, or disrupting service.
Potential impact on your site
Attackers can access or modify plugin functionality and data without permission, compromising site security and user trust.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
