Threats tagged 'ghsa-6vmj-c5pc-9jfw'

The Royal Addons for Elementor WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the Instagram Feed widget's 'instagram_follow_text' setting. This affects all versions up to and including 1.7.1056. The flaw allows authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires prior configuration of the Instagram Feed widget with a valid Instagram access token by an administrator.