CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users.
Explanation of Vulnerability in Simple Terms
The Quix Page Builder Pro extension for Joomla contains a cross-site scripting (XSS) vulnerability in versions 1.0-6.2.0. An authenticated administrator with high privileges can inject malicious scripts that execute in the browser of other users viewing the site. The vulnerability requires administrator access to exploit and does not directly compromise the server.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they view the site.
Potential impact on your site
An admin account compromise could allow script injection affecting site visitors, but server data and files remain protected.
Conditions required to exploit
Attacker must have administrator-level access to the Joomla site.
Key dates
External resources
Related vulnerabilities
