Threats tagged 'ghsa-jh9g-mj9g-p654'

The WP ImageViewer plugin for WordPress up to version 3.0.2 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'img.alt' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. Exploitation requires a front-end content plugin like bbPress to be active, granting necessary capabilities to subscriber-level users. Contributor-level attackers need the ability to submit image HTML in post content, which is the default WordPress behavior. Without such configuration, attackers require custom-level access or higher.