CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Reflected XSS.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.
Explanation of Vulnerability in Simple Terms
WP e-Commerce Style Email versions 0.6.2 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts into email content that execute in a victim's browser when they view the email. The vulnerability requires user interaction—the victim must click a link or visit a page containing the malicious payload. The impact is limited to the affected user's session.
What an attacker can do
Inject malicious scripts that execute in a victim's browser when viewing email content.
Potential impact on your site
Site users can be tricked into executing malicious scripts, potentially compromising their accounts or stealing session data.
Conditions required to exploit
No authentication required. Victim must click a link or visit a page containing the malicious payload.
Key dates
External resources
Related vulnerabilities
