CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Datepicker wp-datepicker allows Stored XSS.This issue affects WP Datepicker: from n/a through <= 2.1.1.
Explanation of Vulnerability in Simple Terms
WP Datepicker versions up to 2.1.1 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator with high privileges can inject malicious scripts through the plugin's input fields. When other users view the affected content, the injected script executes in their browser, potentially compromising their session or stealing sensitive data.
What an attacker can do
Inject malicious JavaScript that executes when other users view the page.
Potential impact on your site
An admin account compromise could allow script injection affecting all site visitors, risking credential theft or malware distribution.
Conditions required to exploit
Attacker must have administrator-level access and a user must view the page containing the injected script.
Key dates
External resources
Related vulnerabilities
