CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-action-box allows DOM-Based XSS.This issue affects Crazy Call To Action Box: from n/a through <= 1.0.5.
Explanation of Vulnerability in Simple Terms
Crazy Call To Action Box versions 1.0.5 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker with low-level site access can inject malicious scripts that execute in other users' browsers when they view affected pages. The vulnerability requires user interaction and can affect multiple site components. Update to a version newer than 1.0.5.
What an attacker can do
Inject malicious scripts that run in other users' browsers, potentially stealing session tokens or modifying page content.
Potential impact on your site
Visitors and staff may have their sessions hijacked or see altered content; site reputation and user trust at risk.
Conditions required to exploit
Attacker needs low-level site access (e.g., contributor role) and the victim must view a page containing the injected script.
Key dates
External resources
Related vulnerabilities
