Threats tagged 'ghsa-c968-6384-5fxw'

The Jupiter X Core plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'forget_password_link' parameter. This affects all versions up to and including 4.61.0. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.