Threats tagged 'ghsa-73fg-xrxx-3cjq'

The Unlimited Elements for Elementor WordPress plugin up to version 2.0.26 is vulnerable to stored cross-site scripting (XSS) via attacker-controlled RSS feed content. This vulnerability allows unauthenticated attackers to inject malicious scripts into pages that render the RSS Feed catalog widget pointing to a malicious feed URL. The issue arises from insufficient input sanitization and output escaping, particularly due to the plugin's escaping pre-processor excluding raw prints and decoding XML entity-encoded payloads back to raw markup.