Threats tagged 'ghsa-294r-rh3h-m5h5'

The LearnPress – Course Review plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'review_title' parameter. This affects all versions up to and including 4.2.2. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when an administrator or users access the injected review page. The vulnerability is triggered after an administrator approves the review, although auto-approval configurations may allow earlier execution.