CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly WP Header Notification wp-header-notification allows Stored XSS.This issue affects WP Header Notification: from n/a through <= 1.2.7.
Explanation of Vulnerability in Simple Terms
WP Header Notification versions 1.2.7 and earlier contain a cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts into notification headers. When another user views the notification, the script executes in their browser, potentially compromising their session or stealing data. The vulnerability requires admin privileges and user interaction to exploit.
What an attacker can do
Inject and execute malicious JavaScript in other users' browsers via notification headers.
Potential impact on your site
Compromised user sessions, credential theft, or malware distribution to site visitors.
Conditions required to exploit
Administrator account access and victim must view the affected notification.
Key dates
External resources
Related vulnerabilities
