CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prism I.T. Systems Multilevel Referral Affiliate Plugin for WooCommerce multilevel-referral-plugin-for-woocommerce allows Reflected XSS.This issue affects Multilevel Referral Affiliate Plugin for WooCommerce: from n/a through <= 2.27.
Explanation of Vulnerability in Simple Terms
The Multilevel Referral Affiliate Plugin for WooCommerce versions 2.27 and earlier contains a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in the browsers of site visitors or administrators. The vulnerability requires user interaction—typically clicking a crafted link—and can affect multiple users across the site. Update the plugin immediately to a version newer than 2.27.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers, stealing cookies, session tokens, or performing actions on their behalf.
Potential impact on your site
Visitors and admins could have their sessions hijacked, credentials stolen, or be redirected to phishing sites without your knowledge.
Conditions required to exploit
No authentication required. Attacker must trick a user into clicking a malicious link or visiting a compromised page.
Key dates
External resources
Related vulnerabilities
