CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Card flip image slideshow card-flip-image-slideshow allows DOM-Based XSS.This issue affects Card flip image slideshow: from n/a through <= 1.5.
Explanation of Vulnerability in Simple Terms
Card flip image slideshow versions 1.5 and earlier contain a stored cross-site scripting vulnerability. An authenticated user with low privileges can inject malicious scripts through the plugin interface. When other users view affected content, the injected code executes in their browsers, potentially compromising their sessions or stealing data. The vulnerability requires user interaction to trigger.
What an attacker can do
Inject malicious JavaScript that executes when other users view the slideshow, stealing sessions or data.
Potential impact on your site
Authenticated users can inject scripts affecting other visitors; your site's security depends on user account trustworthiness.
Conditions required to exploit
Attacker needs a low-privilege account on the site; victim must view the affected slideshow.
Key dates
External resources
