CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Chris WP Editor.md – The Perfect WordPress Markdown Editor wp-editormd allows Stored XSS.This issue affects WP Editor.md – The Perfect WordPress Markdown Editor: from n/a through <= 10.2.1.
Explanation of Vulnerability in Simple Terms
WP Editor.md contains a stored cross-site scripting (XSS) vulnerability in versions up to 10.2.1. An authenticated user with high privileges can inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction to trigger and affects the integrity and confidentiality of the site.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they view affected content.
Potential impact on your site
Site admins or editors could be tricked into viewing malicious content, compromising their accounts or stealing sensitive data.
Conditions required to exploit
Administrator or high-privilege account access; victim must view the page containing the injected script.
Key dates
External resources
Related vulnerabilities
