Threats tagged 'ghsa-j74v-5fcx-qxxv'

The LifterLMS WordPress plugin up to version 10.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'answer[]' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the administrator's browser during quiz grading. Exploitation requires the attacker to be enrolled in a course with a Content-type quiz question and occurs when the administrator clicks 'Start a Review' on the affected attempt.