Threats tagged 'ghsa-678p-m5qh-f4jf'

The Advanced Views – Display Framework for Gutenberg & Elementor WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 3.9.6. This flaw allows unauthenticated attackers to inject malicious scripts that execute whenever a user views a page containing the injected comment. The vulnerability affects even unapproved or pending comments because the plugin's comment retrieval function does not filter by approval status, enabling payload execution before comment review.