Threats tagged 'ghsa-29w8-v8g5-xh8g'

The Redux Framework plugin for WordPress versions up to and including 4.5.15 contains a stored cross-site scripting (XSS) vulnerability via the multi_media field. This occurs because the field's renderer outputs stored values into multiple HTML contexts without proper escaping. Additionally, a flaw in permission checking allows authenticated users with Subscriber-level access to inject scripts into their own profile, which execute when an administrator views that profile. Exploitation requires a theme or plugin that registers a multi_media field through the Redux Users API.