Threats tagged 'ghsa-6hh4-5cgj-w743'

The Post Snippets WordPress plugin up to version 4.2.4 is vulnerable to stored cross-site scripting (XSS) via shortcode attributes. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing entity-encoded payloads to bypass WordPress's standard sanitization and be executed at render time by the plugin's shortcode filter. This requires snippet shortcodes to be enabled.