| Package | Affected versions | Patched versions |
|---|---|---|
| keystone | < 4.0.0 | 4.0.0 |
| keystone | < 4.0.0 | 4.0.0 |
Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize user input on the Contact Us page, allowing attackers to submit contact forms with malicious JavaScript in the message field. The output is not properly encoded leading an admin that opens new inquiry to execute the arbitrary JavaScript supplied in their browser.
Update to version 4.0.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free