Threats tagged 'ghsa-pff7-36wv-mf7h'

The DesignSetGo WordPress plugin up to version 2.11.0 contains a stored cross-site scripting (XSS) vulnerability via the 'tagName' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that become active when an administrator runs the plugin's block-conversion migration during deactivation. This vulnerability requires administrative action to trigger the payload, as attackers cannot activate it independently.