Threats tagged 'ghsa-h4rp-mgwv-m8h3'

The Jupiter X Core plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 4.62.0. This vulnerability arises from insufficient input sanitization and output escaping of the 'fields[<custom_meta_field_id>]' parameter. An unauthenticated attacker can exploit this by injecting malicious scripts into pages where the attacker is assigned as the post author and the page template includes the Raven Author Box widget. The vulnerability allows script execution when users access the affected pages.