Threats tagged 'ghsa-986p-52gw-j792'

The Prime Slider plugin for WordPress versions up to and including 4.7.2 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue is due to the plugin's fallback regex improperly handling allowed attribute values, enabling the injection of active HTML attributes such as event handlers.