CVSS base score
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with a page-creating/editing privilege can embed some malicious script with a crafted HTTP request. When a victim user accesses this page, the script may be executed in the user's web browser.
Explanation of Vulnerability in Simple Terms
MiKa OpenStreetMap contains a cross-site scripting (XSS) vulnerability in versions prior to 6.1.15. An attacker with low-level user privileges can inject malicious scripts that execute in other users' browsers when they visit affected pages. The vulnerability requires user interaction and can affect the confidentiality and integrity of user sessions.
What an attacker can do
Inject malicious scripts that run in other users' browsers to steal session data or modify page content.
Potential impact on your site
User accounts and sessions are at risk; attackers can steal credentials or perform actions as other users.
Conditions required to exploit
Attacker needs a low-privilege user account and must trick a victim into visiting a crafted link or page.
Key dates
External resources
Related vulnerabilities
