Threats tagged 'ghsa-4vjj-g4g8-7pwg'

The Happyforms WordPress plugin up to version 1.38.9 is vulnerable to stored cross-site scripting (XSS) via spoofable client IP headers. The vulnerability arises because the plugin reads raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without validation, stores them as post meta, and later outputs them in the admin interface without proper escaping. This allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the affected submission details.