CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in קידום ובניית אתרים add custom google tag manager add-custom-google-tag-manager allows Stored XSS.This issue affects add custom google tag manager: from n/a through <= 1.0.3.
Explanation of Vulnerability in Simple Terms
A cross-site request forgery (CSRF) vulnerability in Add Custom Google Tag Manager versions 1.0.3 and earlier allows an attacker to perform unauthorized actions on behalf of a site administrator. The vulnerability requires the admin to visit a malicious page while logged in. An attacker can modify plugin settings or inject malicious tracking code. Update to a version newer than 1.0.3.
What an attacker can do
Perform unauthorized actions on the site (modify settings, inject tracking code) by tricking an admin into visiting a malicious page.
Potential impact on your site
An attacker can alter your Google Tag Manager configuration or inject malicious code without your knowledge if you click a malicious link while logged in.
Conditions required to exploit
Site admin must be logged in and visit an attacker-controlled page; no special privileges or direct site access required.
Key dates
External resources
Related vulnerabilities
