Threats tagged 'ghsa-5g9g-cf23-c32r'

The All-in-One Video Gallery plugin for WordPress versions up to and including 4.9.7 is vulnerable to stored cross-site scripting (XSS) via the 'custom_fields[embedcode]' parameter. Authenticated users with subscriber-level access or higher can exploit this vulnerability by injecting malicious scripts through XML-RPC requests, which execute when other users access the affected pages. This occurs due to insufficient input sanitization and output escaping, combined with a logic flaw that grants subscribers publishing capabilities and bypasses sanitization during XML-RPC calls.