Threats tagged 'ghsa-crfc-xm73-w674'

The Optimole WordPress plugin up to version 4.2.18 is vulnerable to stored cross-site scripting (XSS) via the 's (missing_srcsets[*][*].s)' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Additionally, the REST endpoint's HMAC signature, which should protect authorization, is exposed in plaintext to unauthenticated visitors, effectively removing the authentication barrier.