CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Stored XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.6.
Explanation of Vulnerability in Simple Terms
BP Email Assign Templates versions 1.6 and earlier contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts into email templates that execute in the browsers of other users viewing those templates. The vulnerability requires user interaction—a victim must visit a page displaying the affected template—and impacts confidentiality, integrity, and availability within the scope of the application.
What an attacker can do
Inject malicious scripts into email templates that execute when other users view them.
Potential impact on your site
Administrators' accounts and data could be compromised if they view a malicious template; site functionality may be disrupted.
Conditions required to exploit
Attacker must have administrator privileges and the victim must visit a page displaying the affected template.
Key dates
External resources
Related vulnerabilities
