Threats tagged 'ghsa-74q7-5hgm-hhc8'

The Meta Box plugin for WordPress up to version 5.15.2 is vulnerable to stored cross-site scripting (XSS) via the 'profile_background' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when a page is viewed. Exploitation depends on a consuming plugin or theme that exposes this background field and renders stored values insecurely.