Threats tagged 'ghsa-gwvr-j94r-c458'

paicoding versions 1.0.0 through 1.0.3 have a stored cross-site scripting (XSS) vulnerability. This occurs because the SeoInjectService embeds user profile text directly into an inline JSON-LD script element without proper escaping. Authenticated attackers can exploit this by injecting a closing script tag and arbitrary HTML into their profile, which executes scripts in the context of visitors viewing the profile page. This can lead to theft of non-HttpOnly f-session cookies.