CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leroysabrina Simple Social Share Block simple-social-share-block allows Stored XSS.This issue affects Simple Social Share Block: from n/a through <= 1.0.0.
Explanation of Vulnerability in Simple Terms
Simple Social Share Block versions up to 1.0.0 contain a cross-site scripting vulnerability. An attacker with low-level site access can inject malicious scripts that execute in other users' browsers when they interact with the block. The vulnerability requires user interaction and can affect site visitors across different contexts.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view or interact with the social share block.
Potential impact on your site
Site visitors' sessions could be compromised, credentials stolen, or malware injected if a low-privilege user exploits this flaw.
Conditions required to exploit
Attacker needs low-level site access (e.g., contributor role) and the victim must view a page containing the affected block.
Key dates
External resources
Related vulnerabilities
