CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DannyCooper Olympus Shortcodes olympus-shortcodes allows DOM-Based XSS.This issue affects Olympus Shortcodes: from n/a through <= 1.0.4.
Explanation of Vulnerability in Simple Terms
Olympus Shortcodes versions 1.0.4 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with low-level site access can craft a shortcode or input field to execute JavaScript in other users' browsers, potentially stealing session tokens or performing actions on their behalf. The vulnerability requires user interaction—the victim must view a page containing the malicious payload.
What an attacker can do
Inject JavaScript code that runs in other users' browsers when they view affected pages.
Potential impact on your site
Authenticated attackers can steal admin session tokens, deface content, or perform unauthorized actions as other users.
Conditions required to exploit
Attacker needs a low-privilege site account and the victim must view a page with the malicious payload.
Key dates
External resources
Related vulnerabilities
