CVE-2016-20098

EUVD-2016-10914
Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields like pmsubject, header, or reason titles to act with moderators' Reddit sessions.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.31%
Common Weakness Enumeration
References
https://github.com/toolbox-team/reddit-moderator-toolbox
https://github.com/toolbox-team/reddit-moderator-toolbox/commit/26f45ba21d84cecb92b1a820896ad3bf5254376e
https://www.vulncheck.com/advisories/moderator-toolbox-before-4.0.14-stored-xss-via-removal-reasons-configuration