Threats tagged 'ghsa-6gm7-3qhc-38wg'

The Stock Tools plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.1. This vulnerability arises from insufficient input sanitization and output escaping of the 'image_height' and 'image_width' shortcode attributes. Authenticated users with contributor-level access or higher can exploit this flaw to inject arbitrary scripts that execute when other users view the affected pages.