Threats tagged 'ghsa-4pfx-fh23-xm3w'

The Schema & Structured Data for WP & AMP WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its 'saswp_tiny_multiple_faq' shortcode. This affects all plugin versions up to and including 1.51. The flaw arises from insufficient sanitization and escaping of user-supplied attributes, allowing authenticated users with contributor-level access or higher to inject malicious scripts that execute when the affected page is viewed.