Threats tagged 'ghsa-f2j8-6vrw-jhhv'

The VikWidgetsLoader WordPress plugin versions before 1.12.3 contain a vulnerability where several block attributes are not properly sanitized or escaped before being output inside HTML attributes. This flaw allows users with the Contributor role to inject arbitrary JavaScript, which executes in the browsers of users viewing the affected posts, including administrators and editors who review submissions.