Threats tagged 'ghsa-mq7g-375c-hc4x'

The Royal Elementor Addons plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'status' parameter of the wpr_update_form_action_meta AJAX action. This affects all versions up to and including 1.7.1056. The vulnerability arises from insufficient input sanitization and output escaping, combined with a publicly leaked nonce that allows unauthenticated attackers to access the AJAX handler and inject arbitrary scripts. These scripts execute whenever a user accesses an injected page, potentially compromising user data or session integrity.