Threats tagged 'ghsa-3rrf-p83h-c57v'

The SEOPress AI SEO Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter affecting all versions up to and including 10.3. Authenticated users with subscriber-level access or higher can inject malicious scripts via their display name, which are then executed when other users view the affected pages. This occurs due to insufficient input sanitization and output escaping in the plugin's handling of the %%archive_title%% token combined with WordPress's storage of display names without HTML filtering.