Threats tagged 'ghsa-2c44-25vc-hm3p'

The FlexStock plugin for WooCommerce on WordPress is vulnerable to stored Cross-Site Scripting (XSS) via the 'products[].post_content' parameter in all versions up to and including 3.17.2. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping, combined with exposure of the REST bearer token in the Dashboard page source without proper capability checks.