Threats tagged 'ghsa-7929-xh7v-8jrh'

The NMR Strava activities plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in its strava_nmr_connect shortcode. This affects all versions up to and including 1.0.14. The vulnerability arises from insufficient input sanitization and output escaping of user-supplied attributes, allowing authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.