CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Range Slider Addon for Gravity Forms range-slider-addon-for-gravity-forms allows Reflected XSS.This issue affects Range Slider Addon for Gravity Forms: from n/a through <= 1.1.6.
Explanation of Vulnerability in Simple Terms
The Range Slider Addon for Gravity Forms contains a cross-site scripting (XSS) vulnerability in versions up to 1.1.6. An attacker can inject malicious scripts that execute in a victim's browser when they interact with a range slider field. The vulnerability affects the scope beyond the vulnerable component, potentially compromising user sessions or stealing data. Site owners should update to a patched version immediately.
What an attacker can do
Inject and execute malicious JavaScript in a visitor's browser via a range slider field.
Potential impact on your site
Attackers can steal visitor session cookies, redirect users, or deface form content on affected pages.
Conditions required to exploit
Victim must visit a page containing the vulnerable range slider and interact with it.
Key dates
External resources
Related vulnerabilities
