Threats tagged 'ghsa-8jjw-cvh4-g9cw'

The All-in-One Video Gallery WordPress plugin versions prior to 5.1.0 contain a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly escape or sanitize the stored thumbnail URL of videos before outputting it in the admin video list or when written outside its own editor. As a result, users with the Subscriber role can inject malicious scripts that execute in the context of administrator users.