Threats tagged 'ghsa-855c-r2vq-c292'

A stored cross-site scripting (XSS) vulnerability exists in ApostropheCMS versions prior to 4.29.0 in SEO-related fields such as SEO Title and Meta Description. This flaw allows injection of arbitrary JavaScript into HTML contexts including <title>, <meta> attributes, and JSON-LD structured data. Exploitation enables execution of scripts in authenticated admin users' browsers, permitting authenticated API requests and exfiltration of sensitive user data. The vulnerability is patched in version 4.29.0.