Threats tagged 'ghsa-6789-3m6m-fg4v'

The Redux Framework plugin for WordPress versions up to and including 4.5.16 contains a stored cross-site scripting (XSS) vulnerability via the 'content' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, and requires the site's theme to register a color_scheme field on user profiles, exposing a nonce on the profile page for all logged-in users.