Threats tagged 'ghsa-ghqm-2rqq-524j'

The Smart Post WordPress plugin versions up to 4.0.9 are vulnerable to stored cross-site scripting (XSS) via the 'display_name' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users interact with certain page elements. Exploitation requires a page containing an Author Filter block alongside a grid or live-filter block, with script execution triggered by clicking the attacker's author entry in the dropdown filter.