Threats tagged 'ghsa-fpcq-c836-79mc'

The Image Hover Effects Ultimate Visual Composer plugin for WordPress (versions up to 3.1.1) contains a stored cross-site scripting (XSS) vulnerability via the 'flip-box-image-upload-url-01-alt' parameter. This vulnerability arises because the plugin saves the image-alt field without properly escaping double-quote characters and later injects this data into HTML attributes without escaping, enabling script injection. Authenticated users with contributor-level access or higher can exploit this if the plugin's editing capabilities are delegated or in multisite setups with restricted unfiltered_html permissions.