CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nks Email Subscription Popup email-subscribe allows Stored XSS.This issue affects Email Subscription Popup: from n/a through <= 1.2.26.
Explanation of Vulnerability in Simple Terms
Email Subscription Popup versions 1.2.26 and earlier contain a cross-site scripting (XSS) vulnerability. An authenticated administrator with high privileges can inject malicious scripts that execute in other users' browsers when they interact with the popup. The vulnerability requires user interaction and can affect site visitors and administrators. Update to a version newer than 1.2.26.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they interact with the popup.
Potential impact on your site
Administrators with high privileges could inject malicious code affecting site visitors and other admins.
Conditions required to exploit
Attacker must have high-level admin privileges and the victim must visit or interact with an affected popup.
Key dates
External resources
