Threats tagged 'ghsa-fg44-384v-2gf8'

The Password Protected plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its bundled Freemius SDK up to version 2.8.4. This flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts via the 'purchased_plan' parameter in wp-admin requests once the Freemius opt-in is complete. The injected scripts execute automatically when an administrator views standard admin pages, such as their Profile page.