Threats tagged 'ghsa-f2h3-jjvx-q22f'

The Optimole WordPress plugin up to version 4.2.18 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the injected comment to be approved by an administrator and the affected post to include at least one iframe or video element, conditions met under default plugin settings with video lazy loading enabled.