CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny My Default Post Content my-default-post-content allows Stored XSS.This issue affects My Default Post Content: from n/a through <= 0.7.3.
Explanation of Vulnerability in Simple Terms
My Default Post Content versions 0.7.3 and earlier contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with high privileges can inject malicious scripts into post content that execute in the browsers of other users viewing that content. The vulnerability requires user interaction and affects the integrity and confidentiality of site data.
What an attacker can do
Inject malicious scripts into post content that run in other users' browsers.
Potential impact on your site
Compromised admin accounts can inject scripts affecting all site visitors; data theft and account hijacking possible.
Conditions required to exploit
Attacker must have high-level admin privileges and trick a user into viewing the malicious post.
Key dates
External resources
Related vulnerabilities
