CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tubegtld .TUBE Video Curator tube-video-curator allows Reflected XSS.This issue affects .TUBE Video Curator: from n/a through <= 1.1.9.
Explanation of Vulnerability in Simple Terms
The .TUBE Video Curator plugin contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into pages viewed by other users. An attacker can craft a malicious link and trick a user into clicking it, causing the injected code to execute in the victim's browser. This can lead to session hijacking, credential theft, or defacement of site content.
What an attacker can do
Inject malicious JavaScript that executes in other users' browsers when they visit a crafted link.
Potential impact on your site
Visitors can be redirected, have sessions hijacked, or see altered page content depending on the attacker's payload.
Conditions required to exploit
Attacker must trick a user into clicking a malicious link (no authentication required).
Key dates
External resources
Related vulnerabilities
