Threats tagged 'ghsa-cc6h-6xh4-hfv7'

The Hoo Companion WordPress plugin version 1.0.2 contains a Cross-Site Scripting (XSS) vulnerability in one of its import features. This flaw allows unauthenticated attackers to inject arbitrary scripts by submitting unsanitized data, which is stored as the active theme's settings. The injected scripts execute in the context of any user viewing the site, including administrators. Additionally, the exploit destroys the site's existing theme settings.