Threats tagged 'ghsa-g4rw-jrh6-9v37'

The Author Image plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter affecting all versions up to and including 4.9.3. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.