CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Welcome Bar intelly-welcome-bar allows Stored XSS.This issue affects Welcome Bar: from n/a through <= 2.0.4.
Explanation of Vulnerability in Simple Terms
Welcome Bar versions 2.0.4 and earlier contain a cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts through the application, which execute in the browsers of users who view affected pages. The vulnerability requires administrator privileges and user interaction to exploit, and impacts confidentiality, integrity, and availability at a low level.
What an attacker can do
Inject malicious scripts that execute in users' browsers when they view affected pages.
Potential impact on your site
An admin account holder can inject scripts affecting site visitors; scope extends beyond the vulnerable component.
Conditions required to exploit
Administrator account access and the victim must view a page containing the injected script.
Key dates
External resources
Related vulnerabilities
