Threats tagged 'ghsa-ccpv-ph2f-3cx3'

The Graphene WordPress theme up to version 2.9.4 contains a stored cross-site scripting (XSS) vulnerability in the 'Current location' and 'Author profile image URL' profile fields. Authenticated users with Subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.