Threats tagged 'ghsa-fp8q-xhc3-w5c8'

The clubmember WordPress plugin up to version 0.2 is vulnerable to stored cross-site scripting (XSS) via admin settings. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated administrators to inject malicious scripts. The issue specifically affects multi-site WordPress installations and those with unfiltered_html disabled. Exploitation could lead to script execution in users' browsers when accessing injected pages.