Threats tagged 'ghsa-59rm-h9h8-h9gh'

The Sky Addons plugin for WordPress up to version 3.3.2 is vulnerable to stored cross-site scripting (XSS) via the sky-custom-scripts custom post type. Authenticated users with Author-level access or higher can inject malicious scripts through the REST API, which then execute on every frontend page for all visitors. This occurs due to insufficient input sanitization and lack of output escaping in the plugin's handling of the sky_script_content meta field.