CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Image horizontal reel scroll slideshow image-horizontal-reel-scroll-slideshow allows Stored XSS.This issue affects Image horizontal reel scroll slideshow: from n/a through <= 13.4.
Explanation of Vulnerability in Simple Terms
The Image Horizontal Reel Scroll Slideshow plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 13.4. An authenticated administrator can inject malicious JavaScript that executes in the browsers of other users viewing the site. The vulnerability requires the attacker to have high-level admin privileges and the victim to visit an affected page.
What an attacker can do
Inject JavaScript that runs in other users' browsers when they view the site.
Potential impact on your site
A malicious admin can steal session tokens, redirect users, or deface content visible to site visitors.
Conditions required to exploit
Attacker must have administrator-level access; victim must visit a page containing the vulnerable component.
Key dates
External resources
Related vulnerabilities
