CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IWEBIX WP Featured Content Slider wp-featured-content-slider allows Stored XSS.This issue affects WP Featured Content Slider: from n/a through <= 2.6.
Explanation of Vulnerability in Simple Terms
WP Featured Content Slider versions 2.6 and earlier contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts into the plugin's settings that execute in the browsers of other site users. The vulnerability requires administrator privileges and user interaction to exploit, but can affect site visitors and other administrators.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view affected pages.
Potential impact on your site
Site visitors and other admins could be redirected, have sessions hijacked, or have their browsers compromised.
Conditions required to exploit
Administrator account access and victim must visit a page containing the injected content.
Key dates
External resources
Related vulnerabilities
