Threats tagged 'ghsa-7r52-rg5g-qfr5'

The Islamic Phrases plugin for WordPress versions up to and including 2.12.2015 contains a stored cross-site scripting (XSS) vulnerability via the 'phrases' shortcode attribute. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute whenever a user views the affected page, potentially compromising user data and session integrity.