Threats tagged 'ghsa-6m94-vvf4-fh58'

The Slim Jetpack WordPress plugin up to version 2.7.0.1 is vulnerable to stored cross-site scripting (XSS) via the 'g<PAGE_ID>-website' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts into pages containing the [contact-form] shortcode, which execute when accessed by users. The issue arises from insufficient input sanitization and output escaping, combined with nonce and authentication checks that only apply to logged-in users.