Threats tagged 'ghsa-cxg9-r34v-qh6j'

The WP Data Access plugin for WordPress versions up to and including 5.5.89 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient output escaping in the Simple Form autocomplete lookup label, allowing authenticated users with Subscriber-level access or higher to inject malicious scripts. These scripts execute when other users, including those with higher privileges, access the affected pages.