CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jeroen Sormani WP Dashboard Notes allows Stored XSS.This issue affects WP Dashboard Notes: from n/a through 1.0.11.
Explanation of Vulnerability in Simple Terms
WP Dashboard Notes versions up to 1.0.11 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user can inject malicious scripts into dashboard notes that execute when other users view them. The vulnerability requires user interaction and affects the integrity and confidentiality of site data. Update to a version newer than 1.0.11.
What an attacker can do
Inject malicious scripts into dashboard notes that execute in other users' browsers.
Potential impact on your site
Site users' sessions and data can be compromised if they view notes containing malicious scripts.
Conditions required to exploit
Authenticated WordPress user account with access to the plugin; victim must view the affected note.
Key dates
External resources
Related vulnerabilities
