Threats tagged 'ghsa-9v87-xmhx-x7mr'

The Waitlist WooCommerce (Back in stock notifier) plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'type' shortcode attribute. This affects all versions up to and including 2.9.1. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because shortcode attribute values are not sanitized by the wp_kses_post filter and are only processed at render time.