CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ricky Dawn Bot Block – Stop Spam Referrals in Google Analytics bot-block-stop-spam-google-analytics-referrals allows Stored XSS.This issue affects Bot Block – Stop Spam Referrals in Google Analytics: from n/a through <= 2.6.
Explanation of Vulnerability in Simple Terms
Bot Block versions 2.6 and earlier contain a cross-site scripting (XSS) vulnerability that allows an authenticated administrator to inject malicious scripts. The vulnerability requires the attacker to have high-level admin privileges and the victim to interact with a crafted link or page. Successful exploitation can compromise site integrity and expose sensitive data.
What an attacker can do
Inject malicious scripts that execute in the browser of site administrators or other users.
Potential impact on your site
An admin account holder could be tricked into running malicious code that steals data or modifies site content.
Conditions required to exploit
Attacker must have administrator-level access and trick a user into visiting a malicious link or page.
Key dates
External resources
