Threats tagged 'ghsa-p668-6h8q-p85q'

The Social Slider Feed plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the 'slidespeed' parameter affecting all versions up to and including 2.3.8. Authenticated users with subscriber-level access or higher can exploit this flaw to inject malicious scripts that execute on any page embedding the affected feed shortcode. This occurs due to insufficient input sanitization and output escaping, combined with a missing permission check that allows subscribers to bypass capability restrictions and manipulate feed settings.