CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.
Explanation of Vulnerability in Simple Terms
Fyrebox Quizzes versions 3.1 and earlier contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts. An attacker with low-level account access can craft a quiz or form that executes JavaScript in other users' browsers when they interact with the content. The vulnerability affects multiple users across the site due to scope change.
What an attacker can do
Inject JavaScript code that runs in other users' browsers, potentially stealing session tokens or redirecting them to malicious sites.
Potential impact on your site
Authenticated users can compromise other users' sessions or data; site reputation and visitor trust are at risk.
Conditions required to exploit
Attacker must have a low-privilege account on the site; victim must view or interact with the malicious quiz or form.
Key dates
External resources
