Threats tagged 'ghsa-2m93-9jp5-xhh2'

The Themify Builder plugin for WordPress versions up to and including 7.8.4 contains a stored cross-site scripting (XSS) vulnerability in the 'variations' repeater field of Custom Font posts. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts. These scripts execute when a user views the Custom Fonts admin listing page.