Threats tagged 'ghsa-587g-5mg8-jx4r'

The HT Mega – Absolute Addons For Elementor WordPress plugin is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 3.0.0. The vulnerability arises from insufficient input validation on user-supplied HTML tag names in the plugin's Gutenberg blocks, allowing dangerous tags such as 'script', 'iframe', and 'object' to be injected. Authenticated users with contributor-level access or higher can exploit this to inject arbitrary scripts that execute when other users view the affected pages.