Threats tagged 'ghsa-hfpr-hhhq-22gf'

The Wp Parsidate WordPress plugin versions up to and including 6.4 contain a stored cross-site scripting (XSS) vulnerability in the calendar Gutenberg block's 'theme' attribute. This flaw arises from insufficient sanitization and escaping of user input, allowing authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.