CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Workbox Workbox Video from Vimeo & Youtube workbox-video-from-vimeo-youtube-plugin allows Reflected XSS.This issue affects Workbox Video from Vimeo & Youtube: from n/a through <= 3.2.2.
Explanation of Vulnerability in Simple Terms
Workbox Video from Vimeo & Youtube versions 3.2.2 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in a visitor's browser when they view an affected page. The vulnerability requires user interaction and can affect the confidentiality, integrity, and availability of the site.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers to steal data, modify page content, or disrupt site functionality.
Potential impact on your site
Visitors' browsers can be compromised, potentially leading to credential theft, malware distribution, or defacement.
Conditions required to exploit
Visitor must view a page containing the vulnerable component; no authentication required to exploit.
Key dates
External resources
Related vulnerabilities
