CVE-2016-20098

Name of the Vulnerable Software and Affected Versions Moderator Toolbox (reddit-moderator-toolbox) versions prior to 4.0.14

Description A stored cross-site scripting issue exists in the removalreasons module. The software inserts subreddit toolbox wiki fields into popup HTML without proper encoding. This allows attackers with permissions to edit the toolbox wiki page to inject JavaScript into fields such as pmsubject, header, or reason titles, enabling them to perform actions using the sessions of Reddit moderators.

Recommendations Update Moderator Toolbox (reddit-moderator-toolbox) to version 4.0.14 or later.