Threats tagged 'ghsa-2gj6-4vgv-q5hc'

Mbin versions from 1.2.1 up to but not including 1.11.1 contain a stored cross-site scripting (XSS) vulnerability in the EmbedElement::buildDestructed() function. This flaw allows authenticated users to inject HTML in the alt text of images nested inside links within various user-generated content fields, such as entries, comments, posts, messages, or bios. The vulnerability arises because the alt text and URL are rendered without proper HTML escaping, enabling script execution in the browsers of users who view the affected content.