Threats tagged 'ghsa-5gp4-hrgf-7vj6'

The Total theme for WordPress versions up to and including 2.2.1 contains a stored cross-site scripting (XSS) vulnerability via post titles. This occurs due to insufficient output escaping when rendering the_title() inside an HTML attribute context in the home blog section template. Authenticated users with contributor-level access or higher can exploit this by publishing a malicious post with a featured image, causing arbitrary scripts to execute when other users view the injected page.