Threats tagged 'ghsa-8vhf-25gh-rfh5'

The Cozy Blocks plugin for WordPress Block Editor (Gutenberg) versions up to and including 2.2.27 is vulnerable to stored cross-site scripting (XSS) via the 'content' block attribute parameters related to icon.view, icon.layout, and icon.gap. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping, as wp_kses_post does not neutralize certain quote-only attribute-breakout payloads lacking '<' characters, leaving exploitable JSON attributes intact at render time.