Threats tagged 'ghsa-73vg-38g3-f224'

The WPBakery Page Builder plugin for WordPress up to version 9.0.1 is vulnerable to stored cross-site scripting (XSS) via the 'display_name' or 'nickname' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view pages containing the injected content. Successful exploitation requires that a public post by the attacker is displayed through a Basic Grid with a Grid Builder template configured to link to the post author. Author-level users can exploit this without assistance, while subscribers need an administrator to publish a post under their account.