Threats tagged 'ghsa-mpjc-mm6h-74q4'

The Smart Popup WordPress plugin by Supsystic before version 2.0.2 contains a vulnerability where template-injection payloads can be stored and later executed by its template engine. This occurs because the filter intended to remove template delimiters runs before a decoding step that reconstructs them. An authenticated administrator can exploit this to execute arbitrary template expressions on the server, potentially exposing sensitive PHP constants such as database credentials and authentication keys.