Threats tagged 'ghsa-6x88-65v8-2m43'

The Pie Register WordPress plugin up to version 3.8.4.16 is vulnerable to stored cross-site scripting (XSS) via the 'first_name' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires public registration to be enabled and the registration form to include a Profile Picture field. An attacker can register with a crafted payload and then post a comment that triggers the script execution for all visitors of the affected page.