CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osolwordpress Customizable Captcha and Contact Us customizable-captcha-and-contact-us-form allows Reflected XSS.This issue affects Customizable Captcha and Contact Us: from n/a through <= 1.0.2.
Explanation of Vulnerability in Simple Terms
The Customizable Captcha and Contact Us WordPress plugin versions 1.0.2 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in visitors' browsers when they view affected pages. The vulnerability requires user interaction and can affect other users on the site. Update the plugin immediately to a patched version.
What an attacker can do
Inject malicious scripts that run in visitors' browsers and steal data or perform actions on their behalf.
Potential impact on your site
Visitors' sessions and data at risk; attackers can steal credentials, deface content, or redirect users to malicious sites.
Conditions required to exploit
Visitor must view a page containing the injected payload; no authentication required to inject the payload.
Key dates
External resources
Related vulnerabilities
