Threats tagged 'ghsa-34j2-7r4g-h79x'

A Cross-Site Scripting (XSS) vulnerability exists in the BNE Testimonials WordPress plugin before version 2.0.8.2. The plugin fails to properly escape a shortcode attribute used in a JavaScript context, allowing users with contributor role or higher to inject arbitrary JavaScript. This malicious script executes in the browsers of users viewing the affected content. The vulnerability has a medium severity rating with a CVSS score of 5.4.