Threats tagged 'ghsa-47pm-jg2m-gx97'

The Secure Custom Fields WordPress plugin versions before 6.9.8 contain a vulnerability where a persisted field definition is not sanitized before being emitted as an HTML attribute name. This allows a user with the ability to configure fields to store a payload that executes JavaScript in the browsers of users viewing the affected field. In multisite environments, this can enable a site administrator without the unfiltered_html capability to inject script into other users' sessions.