Threats tagged 'ghsa-9prx-xh48-jrgq'

The Greenshift WordPress plugin, used for animation and page builder blocks, suffers from a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability via the 'url (comment_author_url)' parameter in all versions up to and including 13.2.2. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a specific plugin configuration involving the GreenShift Interaction Layer and Counter block attributes, causing the payload to execute for every visitor who loads the affected page once the malicious comment is published.