Threats tagged 'ghsa-7x9h-cjm5-x9fc'

The PPWP – Password Protect Pages plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.9.26. This vulnerability arises from insufficient input sanitization and output escaping of the 'comment / shortcode attribute desc_below_form' parameter. Unauthenticated attackers can inject arbitrary scripts that execute when users access the affected pages. The vulnerability is exacerbated by WordPress's comment_content filter and comment_whitelist setting, allowing auto-approval of subsequent comments from previously approved users without administrator intervention.