Threats tagged 'ghsa-c535-x465-4mxw'

The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'xlwcty_current_date' shortcode. This flaw affects all versions up to and including 2.23.0 and arises from insufficient input sanitization and output escaping of user-supplied attributes. Authenticated users with contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages.