Threats tagged 'ghsa-6q7q-x7h2-hrfr'

The UsersWP WordPress plugin versions up to and including 1.2.80 are vulnerable to stored cross-site scripting (XSS) via the 'badge' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users, especially editors or administrators, view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.