CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Explanation of Vulnerability in Simple Terms
The YouTube Embed, Playlist and Popup by WpDevArt plugin through version 2.6.7 contains a cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other site visitors, potentially stealing session tokens or modifying page content. The vulnerability affects the plugin's core functionality and can impact the entire site.
What an attacker can do
Inject JavaScript code that runs in other users' browsers to steal data or modify site content.
Potential impact on your site
Authenticated users can inject malicious scripts affecting all site visitors; may lead to credential theft or defacement.
Conditions required to exploit
Attacker must have a low-privilege authenticated account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
