Threats tagged 'ghsa-269c-5hmm-363q'

The ARforms WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw via the 'description' parameter in all versions up to and including 7.2.4. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The injected payload is processed through maybe_unserialize(), and if it contains a 'referrer' key, attacker-controlled values are rendered unescaped in the admin entry detail view.