Threats tagged 'ghsa-5xcm-rr4h-p45v'

The User Frontend WordPress plugin versions before 4.3.14 contain a reflected cross-site scripting (XSS) vulnerability. This occurs because some user-supplied values are not properly sanitized or escaped before being reflected in HTML attributes in an AJAX response accessible to the public. The vulnerable action is protected by a nonce that only validates for logged-out users, so the XSS payload executes against visitors who are not authenticated.