Threats tagged 'ghsa-fpxx-c5px-2wmw'

The Live Composer WordPress plugin versions before 2.1.24 contain a vulnerability where some page-builder module settings are not properly sanitized and escaped. This flaw allows users with access to the builder, typically administrators, to inject arbitrary JavaScript code. The injected script executes when any visitor views the affected page, impacting even administrators in multisite environments where the unfiltered_html capability is disabled.