CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Vzaar Media Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on the $_SERVER['PHP_SELF'] variable. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
Vzaar Media Management versions 1.2 and earlier contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. An attacker with network access can craft input that executes in users' browsers without authentication. The vulnerability affects the integrity of user interactions but does not compromise confidentiality or availability.
What an attacker can do
Inject malicious scripts that execute in users' browsers when they view affected pages.
Potential impact on your site
Users visiting affected pages may have malicious scripts run in their browsers, potentially stealing session tokens or redirecting them to phishing sites.
Conditions required to exploit
Network access to the application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
