Threats tagged 'ghsa-f35f-w577-x9q2'

The ThirstyAffiliates WordPress plugin up to version 3.12.1 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use block themes like Twenty Twenty-Five and that the attacker has a previously approved comment, enabling subsequent crafted comments to be auto-approved and publicly rendered.