Threats tagged 'ghsa-999f-q85h-g4q7'

The WP Airbnb Review Slider plugin for WordPress versions up to and including 4.2 is vulnerable to stored cross-site scripting (XSS) via admin settings. This vulnerability arises from insufficient URL validation, allowing authenticated administrators to inject malicious HTML content. The issue affects only multi-site WordPress installations or those where the unfiltered_html capability is disabled. Exploitation requires administrator-level permissions and user interaction to trigger the injected script. The vulnerability has a medium severity rating with a CVSS score of 4.0.