CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vasilis Triantafyllou Flag Icons language-icons-flags-switcher allows Stored XSS.This issue affects Flag Icons: from n/a through <= 2.2.
Explanation of Vulnerability in Simple Terms
Flag Icons contains a cross-site scripting (XSS) vulnerability affecting versions 2.2 and earlier. An authenticated user with high privileges can inject malicious scripts by crafting a specially crafted request. The vulnerability requires user interaction and can affect other users or components. Update to a version newer than 2.2 to remediate.
What an attacker can do
Inject malicious scripts that execute in other users' browsers or affect site functionality.
Potential impact on your site
Authenticated admins could be tricked into executing scripts that compromise site integrity or steal session data.
Conditions required to exploit
Attacker must have high-level admin or privileged account access and trick a user into visiting a malicious link.
Key dates
External resources
