CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows Stored XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.
Explanation of Vulnerability in Simple Terms
Advanced FAQ Manager versions up to 1.5.2 contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. The vulnerability requires user interaction—typically a victim clicking a crafted link—and can affect other users on the site. An attacker with admin privileges can inject code that executes in the browsers of site visitors, potentially stealing session data or modifying page content.
What an attacker can do
Inject malicious scripts that execute in visitors' browsers and steal session data or modify page content.
Potential impact on your site
Admins with malicious intent can compromise visitor sessions and data; requires immediate update to prevent insider threats.
Conditions required to exploit
Admin-level access to the site and the victim must click a crafted link or visit a malicious page.
Key dates
External resources
