CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ersatzpole ML Responsive Audio player with playlist Shortcode mlr-audio allows Stored XSS.This issue affects ML Responsive Audio player with playlist Shortcode: from n/a through <= 0.2.
Explanation of Vulnerability in Simple Terms
The ML Responsive Audio Player with Playlist Shortcode plugin contains a stored cross-site scripting (XSS) vulnerability in versions 0.2 and earlier. An authenticated user with low privileges can inject malicious scripts through the plugin's shortcode functionality. When other users view pages containing the affected shortcode, the injected script executes in their browser, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on their behalf.
What an attacker can do
Inject and execute malicious JavaScript in other users' browsers when they view affected pages.
Potential impact on your site
Authenticated users can inject scripts that compromise other visitors' sessions and data without admin intervention.
Conditions required to exploit
Attacker must be logged in with low-level user privileges and the victim must visit a page with the malicious shortcode.
Key dates
External resources
Related vulnerabilities
