CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 1.8.2.
Explanation of Vulnerability in Simple Terms
Search Atlas SEO versions 1.8.2 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. An attacker with high-level privileges can craft a request that, when visited by another user, executes arbitrary JavaScript in their browser. The vulnerability affects the site's integrity and user data confidentiality.
What an attacker can do
Inject malicious JavaScript that executes in other users' browsers when they visit affected pages.
Potential impact on your site
Administrators with malicious intent can steal session tokens, modify site content, or harvest user data from other admins.
Conditions required to exploit
Attacker must have administrator-level access and the victim must visit a page containing the malicious payload.
Key dates
External resources
Related vulnerabilities
