CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows Stored XSS.This issue affects Mortgage Calculator Estatik: from n/a through <= 2.0.12.
Explanation of Vulnerability in Simple Terms
The Mortgage Calculator Estatik plugin contains a cross-site scripting (XSS) vulnerability that allows authenticated users with low privileges to inject malicious scripts. An attacker can craft input that executes arbitrary JavaScript in the browsers of site visitors, potentially stealing session tokens, redirecting users, or defacing content. The vulnerability requires network access and some technical setup but does not require user interaction beyond normal site usage.
What an attacker can do
Run malicious JavaScript in visitors' browsers to steal data, redirect users, or modify page content.
Potential impact on your site
Visitor accounts and data at risk; site reputation damage if malicious scripts are injected into pages.
Conditions required to exploit
Attacker must have a low-privilege account on the site; network access to the vulnerable plugin.
Key dates
External resources
Related vulnerabilities
