Threats tagged 'ghsa-g6pv-q7rc-97m5'

The Modula WordPress plugin versions up to and including 3.0.17 are vulnerable to stored cross-site scripting (XSS) via the 'items' parameter. This vulnerability arises from insufficient sanitization of the per-image 'link' field in certain REST handlers and functions, allowing authenticated users with Author-level access or higher to inject malicious scripts. These scripts execute when users access the affected pages and interact with the gallery tiles.