Threats tagged 'ghsa-p9xc-cphq-3q9h'

The Schedule Post Changes With PublishPress Future plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'wrapper' attribute of the [futureaction] shortcode. This affects all versions up to and including 4.10.0. The vulnerability arises from improper sanitization of the wrapper attribute, allowing authenticated users with administrator-level access or higher to inject arbitrary scripts that execute when the affected page is viewed. This can potentially be abused by lower-privileged users if administrators enable this functionality for them.