Threats tagged 'ghsa-hqqj-gc9v-4p47'

A stored cross-site scripting (XSS) vulnerability exists in the Dynific Addons for Elementor WordPress plugin versions before 1.3.1. The plugin fails to properly escape post titles before outputting them in a quoted HTML attribute within an Elementor widget. This allows authenticated users with the Author role to publish posts with titles that execute arbitrary scripts in the browsers of users who view them, including administrators.