CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
Explanation of Vulnerability in Simple Terms
RT-Theme 18 Extensions contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability affects all versions up to 2.5 and requires user interaction to exploit. An attacker can steal session cookies, redirect users, or deface site content by tricking a victim into clicking a malicious link.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers, stealing cookies or redirecting them to phishing sites.
Potential impact on your site
Site visitors can be redirected to malicious sites or have their session cookies stolen, compromising their accounts.
Conditions required to exploit
No authentication required. Victim must click an attacker-supplied link or visit a compromised page.
Key dates
External resources
Related vulnerabilities
