CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thimo Grauerholz WP-Spreadplugin wp-spreadplugin allows Cross-Site Scripting (XSS).This issue affects WP-Spreadplugin: from n/a through <= 4.8.9.
Explanation of Vulnerability in Simple Terms
WP-Spreadplugin versions 4.8.9 and earlier contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts into the plugin that execute in other users' browsers. The vulnerability requires user interaction—victims must view a page containing the injected content. Impact is limited to low-severity data exposure and site defacement.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view affected pages.
Potential impact on your site
Administrators can inject scripts affecting other users; limited to low-severity data exposure and site defacement.
Conditions required to exploit
Administrator account access; victim must view a page containing the injected script.
Key dates
External resources
Related vulnerabilities
