Threats tagged 'ghsa-22hp-rp2j-wf97'

The LiteSpeed Cache plugin for WordPress versions up to and including 7.9.1 contains a stored cross-site scripting (XSS) vulnerability via the 'bbp_reply_content' parameter. This flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that attackers can embed in user-generated content such as bbPress topics. The vulnerability has a CVSS score of 6.4, indicating a medium severity level.