Threats tagged 'ghsa-64wh-p786-vprv'

The GeoDirectory WordPress plugin versions before 2.8.196 contain a vulnerability where a post badge click-through link is not properly sanitized or escaped. This flaw allows users with Contributor role or higher to inject stored cross-site scripting (XSS) payloads that execute when higher-privileged users, such as administrators, view the affected listing.