Threats tagged 'ghsa-f57m-jfx5-32g7'

A stored Cross-Site Scripting (XSS) vulnerability exists in the wp-review-slider-pro WordPress plugin before version 12.7.12. The plugin fails to perform a capability check on one of its AJAX handlers, and the nonce protecting this handler is generated for every visitor, allowing any authenticated user, including low-privileged roles like subscribers, to inject arbitrary review content. This malicious content is then output without proper escaping on public pages, leading to stored XSS.