CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS.This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.
Explanation of Vulnerability in Simple Terms
FSM Custom Featured Image Caption versions up to 1.25.1 contain a cross-site scripting (XSS) vulnerability in image caption handling. An authenticated user with high privileges can inject malicious scripts that execute in the browsers of other site users who view the affected content. The vulnerability requires user interaction and can affect multiple components of the site.
What an attacker can do
Inject malicious scripts into image captions that execute when other users view the content.
Potential impact on your site
Compromised admin or editor accounts can inject scripts affecting all site visitors, potentially stealing credentials or modifying content.
Conditions required to exploit
Attacker must have high-level admin or editor privileges and the victim must view a page containing the malicious caption.
Key dates
External resources
Related vulnerabilities
