Threats tagged 'ghsa-733m-h5rr-xxrp'

The Document Embedder plugin for WordPress up to version 2.4.0 is vulnerable to a stored DOM-based cross-site scripting (XSS) flaw. Authenticated users with contributor-level access or higher can inject malicious scripts via the 'content' parameter in post content JSON. The injected scripts execute when a user clicks the embedded document's Download button, exploiting an AJAX fallback that improperly handles authorization checks. This vulnerability arises from insufficient input sanitization and output escaping.