Threats tagged 'ghsa-7j4j-gp82-9ppj'

The AI Marketing Expert WordPress plugin (up to version 1.2.8) contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'name' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of administrators accessing the injected pages. Exploitation requires the chatbot module to be active with at least one configured bot. The attack involves storing the payload via unauthenticated REST calls, which is then delivered through the JavaScript widget's auto-polling mechanism.