Threats tagged 'ghsa-57m3-rqpq-7chf'

The VikRentCar Car Rental Management System plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'className' parameter in all versions up to and including 1.4.10. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because input sanitization and output escaping are insufficient, allowing payloads to break out of HTML attribute contexts despite the use of wp_kses_post() at save time.