CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp-maverick WP Parallax Content Slider wp-parallax-content-slider allows Stored XSS.This issue affects WP Parallax Content Slider: from n/a through <= 0.9.8.
Explanation of Vulnerability in Simple Terms
WP Parallax Content Slider versions 0.9.8 and earlier contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator with high privileges can inject malicious JavaScript into the plugin's settings. When other users view affected pages, the injected script executes in their browsers, potentially stealing session data or performing actions on their behalf. The vulnerability requires both admin access and user interaction to trigger.
What an attacker can do
Inject malicious JavaScript that executes in visitors' browsers when they view the affected slider.
Potential impact on your site
Attackers with admin access can compromise visitor sessions and data; scope extends beyond the plugin to the entire site.
Conditions required to exploit
Administrator account (high privileges) and victim must view a page containing the compromised slider.
Key dates
External resources
Related vulnerabilities
