Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website. An attacker who successfully exploited this vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability, could gain the same user rights as the current user.