CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pedjas Stop Comment Spam stop-comment-spam allows Stored XSS.This issue affects Stop Comment Spam: from n/a through <= 0.5.3.
Explanation of Vulnerability in Simple Terms
Stop Comment Spam versions 0.5.3 and earlier contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts. An attacker can craft a malicious link that, when clicked by a site visitor, executes JavaScript in the victim's browser. This can lead to session hijacking, credential theft, or malware distribution. Update to a version newer than 0.5.3.
What an attacker can do
Inject and execute malicious JavaScript in visitors' browsers via a crafted link.
Potential impact on your site
Visitors' sessions and credentials can be compromised; malware or phishing content can be injected into pages.
Conditions required to exploit
A site visitor must click an attacker-controlled link while logged into or visiting the affected site.
Key dates
External resources
Related vulnerabilities
