Threats tagged 'ghsa-g5mm-h736-h3g3'

A stored cross-site scripting (XSS) vulnerability exists in the JetEngine WordPress plugin before version 3.8.13.1. The plugin fails to sanitize uploaded SVG files and does not properly restrict upload permissions, allowing unauthenticated attackers to upload malicious JavaScript. This script executes in the browsers of users who open the malicious SVG file, potentially leading to information disclosure or session hijacking.