CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CantonBolo WordPress 淘宝客插件 taobaoke allows Reflected XSS.This issue affects WordPress 淘宝客插件: from n/a through <= 1.1.2.
Explanation of Vulnerability in Simple Terms
The WordPress 淘宝客插件 (Taobao Affiliate Plugin) versions 1.1.2 and earlier contain a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in the browsers of site visitors or administrators. The vulnerability affects the plugin's handling of user input, allowing script injection through the plugin's interface or data fields.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers, stealing cookies, session tokens, or performing actions on their behalf.
Potential impact on your site
Visitor accounts and admin sessions can be compromised; malware or phishing content can be injected into your site.
Conditions required to exploit
A site visitor or admin must view a page containing the attacker's injected payload; no authentication required to inject the script.
Key dates
External resources
Related vulnerabilities
