Threats tagged 'ghsa-p54m-c67r-w58j'

The Posts Table with Search & Sort plugin for WordPress versions up to and including 1.4.14 contains a stored cross-site scripting (XSS) vulnerability via the 'date_format' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing the payload to bypass WordPress's wp_kses_post filter by reconstructing malicious HTML tags only at render time.