Threats tagged 'ghsa-242h-7rp5-ph5c'

The QODE Wishlist for WooCommerce plugin for WordPress versions up to and including 1.2.9 is vulnerable to stored cross-site scripting (XSS) via the 'qode_wishlist_for_woocommerce_guests_items' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Exploitation requires an attacker to craft a share URL with malicious content and an administrator to take an action to trigger the vulnerability. The vulnerability is rated medium severity with a CVSS score of 6.1.