CVE-2023-24001

Medium
|4.8
No Exploit

Plain English Summary

AI-powered analysis for quick understanding

This vulnerability allows an attacker with admin access to inject malicious scripts into the modal dialog plugin, which can then execute when other users interact with the affected site. It requires the attacker to have administrative privileges to exploit the flaw, making it a risk for sites where admin accounts could be compromised.

Technical Description

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yannick Lefebvre Modal Dialog plugin <= 3.5.9 versions.

CVSS Vector Analysis

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredHigh
User InteractionRequired
Confidentiality ImpactLow
Integrity ImpactLow
Availability ImpactNone
ScopeChanged

Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploit Resources

Search for proof-of-concept code and exploit modules

Official References

Est. Bounty
$638($500-$1K)
Vendor Response
Grade FPatched in 1062 days

Quick Information

Published

Apr 6, 2023

about 3 years ago

Last Modified

Mar 3, 2026

about 1 month ago

Vendor

ylefebvre

Product

modal dialog