CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through <= 0.9.7.
Explanation of Vulnerability in Simple Terms
Admin Options Pages versions 0.9.7 and earlier contain a cross-site scripting (XSS) vulnerability in how they handle user input on admin pages. An attacker can inject malicious scripts that execute in the browsers of site administrators who visit a crafted link. The vulnerability requires user interaction and can affect multiple users across the site.
What an attacker can do
Inject malicious scripts that run in admin browsers, potentially stealing credentials or performing unauthorized actions.
Potential impact on your site
Admins visiting malicious links could have their sessions compromised or be tricked into performing unintended actions.
Conditions required to exploit
An admin must click a malicious link or visit a crafted page; no authentication required from the attacker.
Key dates
External resources
Related vulnerabilities
