Stored XSS Vulnerability in YOOtheme Pagekit by YOOtheme
CVE-2018-11564
4.8MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2018-11564?
The vulnerability permits users with elevated privileges to upload harmful SVG files through the image upload interface in YOOtheme Pagekit versions 1.0.13 and earlier. When exploited, the malicious code can be executed on the website, potentially allowing attackers to execute arbitrary scripts in the context of other users. This poses significant risks as unsuspecting users may inadvertently trigger the XSS attack when interacting with links that lead to these malicious files.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.