Threats tagged 'ghsa-832v-j8jj-hrq5'

The Shield Security WordPress plugin up to version 22.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'REQUEST_URI' parameter due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user accesses the affected page. The issue stems from the hidden 'path' column in ForTraffic.php, which is rendered using innerHTML without proper escaping, making it exploitable despite a partial fix applied only to the visible 'page' column in version 18.5.8.