CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristián Lávaque s2Member s2member allows Reflected XSS.This issue affects s2Member: from n/a through <= 241216.
Explanation of Vulnerability in Simple Terms
s2Member contains a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction—typically clicking a malicious link—and can affect multiple users across the site. Versions up to 241216 are affected. Update to a version newer than 241216 to remediate.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers and steals session data or performs actions on their behalf.
Potential impact on your site
Site users can be tricked into executing attacker code, risking account compromise and data theft.
Conditions required to exploit
No authentication required. Victim must click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
