CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarvesh M Rao WP Discord Invite wp-discord-invite allows Stored XSS.This issue affects WP Discord Invite: from n/a through <= 2.5.3.
Explanation of Vulnerability in Simple Terms
WP Discord Invite versions 2.5.3 and earlier contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious JavaScript that executes in the browsers of other users viewing affected pages. The vulnerability requires administrator privileges and user interaction to exploit, but can affect site visitors across the application.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they view affected pages.
Potential impact on your site
Site administrators could be tricked into visiting a malicious page, allowing attackers to steal session tokens or perform actions as that admin.
Conditions required to exploit
Administrator account access and victim must visit a page containing the injected payload.
Key dates
External resources
Related vulnerabilities
