Threats tagged 'ghsa-2723-m3jj-w933'

A stored cross-site scripting (XSS) vulnerability exists in paicoding between commits 766c48b and 903adce. The flaw occurs in payment notifications where the payer's display name is inserted without escaping and rendered unsafely, allowing authenticated attackers to inject malicious scripts. This script executes in the author's browser when viewing notifications related to pending payments on paid articles.