CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The EM Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to the plugin storing attacker-controlled 'customer_name' data and rendering it in the admin customer list without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the EMCC Customers page.
Explanation of Vulnerability in Simple Terms
EM Cost Calculator versions 2.3.1 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in a victim's browser when they visit a crafted link or page. The vulnerability affects the application's scope, potentially impacting other users or components. No authentication is required to exploit this issue.
What an attacker can do
Inject malicious scripts that run in a victim's browser to steal data or perform actions on their behalf.
Potential impact on your site
Users visiting crafted links could have their session data stolen or be tricked into performing unintended actions within the application.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page while logged into or viewing the affected application.
Key dates
External resources
