Threats tagged 'ghsa-8gwf-q9gc-gx6r'

The Live Composer WordPress plugin versions before 2.1.24 contain a vulnerability where several attributes of a page-builder shortcode are not properly escaped before being output inside HTML tag attributes. This flaw allows users with Contributor role or higher to store malicious payloads that execute in the browsers of anyone viewing the affected post, including administrators reviewing submissions.