Threats tagged 'ghsa-7f9m-hhf7-j63p'

The Echo Knowledge Base plugin for WordPress versions up to and including 17.214.0 is vulnerable to reflected cross-site scripting (XSS) via the 'new_kb_config' parameter. This occurs because attacker-controlled JSON data can be merged into the knowledge base configuration and injected into a <style> element without proper escaping. The vulnerability requires the attacker to trick a user with Editor-level or higher privileges into clicking a crafted link, leading to script execution in the context of the victim's browser.