Threats tagged 'ghsa-hgjp-cmxx-r459'

The HotelRunner Booking Widget plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'hotelrunner' shortcode. This flaw affects all versions up to and including 5.2.4 and arises from insufficient input sanitization and output escaping of user-supplied attributes. Authenticated users with contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages.