Threats tagged 'ghsa-g435-8rf2-7v92'

The JS Help Desk plugin for WordPress up to version 5.0.2 contains a stored DOM-based cross-site scripting (XSS) vulnerability via the 'jsticket_message' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when an administrator or agent views the affected ticket. The vulnerability arises from insufficient input sanitization and output escaping, specifically when the page initializes VenoBox and processes the data-title attribute with jQuery .html().