CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the front end alert-box-block allows Stored XSS.This issue affects Alert Box Block – Display notice/alerts in the front end: from n/a through <= 1.1.0.
Explanation of Vulnerability in Simple Terms
Alert Box Block for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.1.0. An authenticated user with low privileges can inject malicious scripts into alert box content. When other users view the page, the scripts execute in their browsers, potentially compromising their sessions or data. The vulnerability requires user interaction to trigger the malicious payload.
What an attacker can do
Inject malicious scripts that execute when other users view the alert box, stealing sessions or modifying page content.
Potential impact on your site
Visitors' browser sessions and data can be compromised if they view an alert box containing injected malicious code.
Conditions required to exploit
Attacker needs a low-privilege WordPress account and must trick a user into viewing the compromised alert box.
Key dates
External resources
Related vulnerabilities
