CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biancardi Mixcloud Embed mixcloud-embed allows Stored XSS.This issue affects Mixcloud Embed: from n/a through <= 2.2.0.
Explanation of Vulnerability in Simple Terms
The Mixcloud Embed plugin contains a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with low-level site access can craft a malicious link or embed code that executes JavaScript in other users' browsers when they view the affected page. The vulnerability requires user interaction and can affect other site visitors.
What an attacker can do
Inject and execute JavaScript code in other users' browsers to steal session tokens, redirect users, or deface content.
Potential impact on your site
Site visitors' sessions and data can be compromised if an authenticated attacker injects malicious embed code.
Conditions required to exploit
Attacker needs a low-privilege site account and must trick a user into clicking a malicious link or visiting a compromised page.
Key dates
External resources
Related vulnerabilities
