Threats tagged 'ghsa-f2cq-gqfx-m35m'

The CSS & JavaScript Toolbox plugin for WordPress versions up to and including 12.0.5 is vulnerable to stored cross-site scripting (XSS) via admin settings. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with administrator-level permissions or higher to inject arbitrary scripts. The issue specifically affects multi-site installations and those with unfiltered_html disabled. The vulnerability has a medium severity rating with a CVSS score of 4.4.