Threats tagged 'ghsa-2r7v-fqcv-v2p7'

The Content Pilot plugin for WordPress versions up to and including 2.2.4 is vulnerable to stored cross-site scripting (XSS). The vulnerability arises because the plugin processes HTML meta descriptions from remotely fetched articles without proper sanitization before storing them as post content. This allows unauthenticated attackers who control RSS feed content configured in the plugin to inject malicious scripts that execute when users view the affected pages.