Threats tagged 'ghsa-3gwr-hcgg-p3rv'

Shopclass versions before 6.2.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows self-registered non-admin users to inject malicious JavaScript into item listing descriptions when the frontend TinyMCE editor is enabled. The injected scripts are saved without proper tag stripping and execute in the context of the site origin for any visitor viewing the affected listing. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.