GHSA-h685-83w4-3ph3MediumCVSS 6.1

iziModal Cross-site Scripting vulnerability

Published
February 21, 2023
Last Modified
February 22, 2023

🔗 CVE IDs covered (1)

CVE-2021-32860 →

📋 Description

iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker who is able to influence the field title when creating a iziModal instance is able to supply arbitrary html or javascript code that will be rendered in the context of a user, potentially leading to XSS. Version 1.6.1 contains a patch for this issue

🎯 Affected products1

  • npm/izimodal:< 1.6.1

🔗 References (5)