Threats tagged 'ghsa-5h5f-r6q7-c9qh'

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the `wfop_phone` shortcode. This flaw affects all versions up to and including 3.13.1.2 and arises from insufficient input sanitization and output escaping of the user-supplied `default` attribute. Authenticated users with Contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages.