Threats tagged 'ghsa-8p3w-9597-pwh9'

The Maxi Blocks WordPress plugin versions up to and including 2.1.9 contain a stored cross-site scripting (XSS) vulnerability in the /wp-json/maxi-blocks/v1.0/style-card REST API endpoint. This vulnerability arises from insufficient sanitization and escaping of the sc_styles parameter, allowing authenticated users with Author-level or higher privileges to inject malicious scripts. These scripts execute on every page where the plugin's style card styles are loaded, including the WordPress admin panel.