CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SecuPress SecuPress Free secupress allows DOM-Based XSS.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.
Explanation of Vulnerability in Simple Terms
SecuPress Free versions up to 2.2.5.3 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts that execute in other users' browsers, including administrators. The vulnerability requires user interaction to trigger. Impact is limited to confidentiality and integrity of affected sessions.
What an attacker can do
Inject malicious scripts that run in other users' browsers, potentially stealing session data or performing actions as those users.
Potential impact on your site
Low-privilege users can compromise admin sessions or steal data from other users visiting affected pages.
Conditions required to exploit
Attacker must have a low-privilege account on the site; victim must view a page containing the injected script.
Key dates
External resources
Related vulnerabilities
