Threats tagged 'ghsa-3f2v-jx9m-xwjg'

A Cross-Site Scripting (XSS) vulnerability exists in the Contact Form by Supsystic WordPress plugin versions before 1.8.0. The plugin fails to properly sanitize and escape the form name, allowing users with form editor access to inject arbitrary scripts. On multisite WordPress installations, this vulnerability can be exploited to cross privilege boundaries when administrators lack the unfiltered_html capability.