CVE-2023-36530

23th percentile - higher than 23% of all known CVEs

The Smartypants SP Project & Document Manager plugin versions up to 4.67 contains a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.

Exploitation of this vulnerability may lead to session data theft, administrator account takeover, or other malicious actions. Organizations should be aware of the risks associated with unauthorized access to data.

It is recommended to update the Smartypants SP Project & Document Manager plugin to the latest version to eliminate this vulnerability. Additionally, conducting a security audit of the application to identify other potential flaws is advisable.