Threats tagged 'ghsa-fxpc-x8v9-wxxx'

The Cozy Blocks plugin for WordPress, used for building websites with the WordPress Block Editor and integrating Gutenberg blocks, is vulnerable to stored cross-site scripting (XSS) via the 'productRating.iconColor' parameter. This vulnerability affects all versions up to and including 2.2.27. It allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability is triggered only when the productRating feature is enabled and the WooCommerce product has a non-zero rating.