CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nurul Amin WP Smart Tooltip wp-smart-tool-tip allows Stored XSS.This issue affects WP Smart Tooltip: from n/a through <= 1.0.0.
Explanation of Vulnerability in Simple Terms
WP Smart Tooltip versions 1.0.0 and earlier contain a cross-site scripting (XSS) vulnerability. An authenticated user can inject malicious scripts into tooltip content that execute in other users' browsers when they view the affected page. The vulnerability requires user interaction and can affect site visitors across different security contexts.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view tooltips.
Potential impact on your site
Authenticated users can inject JavaScript that steals visitor data, session tokens, or performs actions on behalf of site visitors.
Conditions required to exploit
Attacker must have low-level site access (e.g., contributor role) and the victim must view a page containing the malicious tooltip.
Key dates
External resources
Related vulnerabilities
