Threats tagged 'ghsa-6x99-gc47-w4j4'

A stored cross-site scripting (XSS) vulnerability exists in the PublishPress Authors plugin for WordPress affecting all versions up to and including 4.17.0. The flaw is due to insufficient input sanitization and output escaping of the 'name' parameter mapped to display_name. Authenticated users with subscriber-level access or higher can exploit this by injecting malicious scripts that execute when other users view the affected pages. Exploitation requires the attacker to have a mapped author term, which occurs when assigned as a co-author or if automatic author term creation is enabled for their role. This mapping is not present by default on a stock installation.