CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Page Builder Addons Web and WooCommerce Addons for WPBakery Builder allows Stored XSS.This issue affects Web and WooCommerce Addons for WPBakery Builder: from n/a through 1.4.6.
Explanation of Vulnerability in Simple Terms
A stored cross-site scripting (XSS) vulnerability exists in Web and WooCommerce Addons for WPBakery Builder up to version 1.4.6. An authenticated administrator with high privileges can inject malicious scripts through the plugin interface. When other users view affected pages, the injected code executes in their browsers, potentially compromising their sessions or stealing data.
What an attacker can do
Inject malicious JavaScript that runs when other users view the site, potentially stealing their session data or credentials.
Potential impact on your site
Compromised admin accounts can inject persistent malicious code affecting all site visitors; requires immediate patching and audit of admin activity.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site and a victim must view a page containing the injected code.
Key dates
External resources
Related vulnerabilities
