CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Reflected XSS.This issue affects Advanced Control Manager for WordPress by ItalyStrap: from n/a through <= 2.16.0.
Explanation of Vulnerability in Simple Terms
Advanced Control Manager for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the site. An attacker can craft a malicious input that, when viewed by site administrators or other users, executes arbitrary JavaScript in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
What an attacker can do
Inject malicious JavaScript that executes in the browsers of site administrators and other users.
Potential impact on your site
Attackers can steal admin session cookies, modify site content, create new admin accounts, or redirect users to malicious sites.
Conditions required to exploit
User interaction required; victim must view a page containing the attacker's injected payload. No authentication required to inject the payload.
Key dates
External resources
Related vulnerabilities
