Threats tagged 'ghsa-jhch-7rhx-vfrf'

The Flying Images WordPress plugin up to version 2.4.15 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Initial comments require administrator approval, but subsequent comments from the same user bypass moderation, causing persistent script execution for all visitors, including administrators.