CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suman Biswas Custom top bar custom-top-bar allows Stored XSS.This issue affects Custom top bar: from n/a through <= 2.1.
Explanation of Vulnerability in Simple Terms
Custom top bar versions 2.1 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in visitors' browsers when they view pages containing the vulnerable component. The attack requires user interaction—typically clicking a crafted link—and can affect other users on the site. Patch status is unknown; contact the vendor for updates.
What an attacker can do
Inject and execute malicious JavaScript in visitors' browsers to steal session tokens, redirect users, or deface content.
Potential impact on your site
Visitors' accounts and data at risk; site reputation damage if used for phishing or malware distribution.
Conditions required to exploit
Visitor must click a malicious link or visit an attacker-controlled page; no authentication required.
Key dates
External resources
Related vulnerabilities
