Threats tagged 'ghsa-7w5g-7c7h-5f8j'

The Dynific Addons for Elementor WordPress plugin versions before 1.3.1 contains a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with the Author role to inject malicious scripts via a user-controlled profile value that is not properly escaped in a quoted attribute within an Elementor widget. When an administrator or any user views a post authored by the attacker, the stored payload executes in their session.