CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Logo Slider allows DOM-Based XSS. This issue affects WEN Logo Slider: from n/a through 3.4.0.
Explanation of Vulnerability in Simple Terms
WEN Logo Slider through version 3.4.0 contains a stored cross-site scripting (XSS) vulnerability. An authenticated user with high privileges can inject malicious scripts into the slider configuration. When other users view pages containing the slider, the injected code executes in their browsers, potentially compromising their sessions or stealing data.
What an attacker can do
Run malicious JavaScript in the browsers of site visitors viewing the affected slider.
Potential impact on your site
Compromised admin accounts could inject persistent malware affecting all site visitors; visitor sessions and data at risk.
Conditions required to exploit
Attacker must have high-level admin or editor privileges and the victim must visit a page with the slider.
Key dates
External resources
Related vulnerabilities
