Threats tagged 'ghsa-pgwq-g4vx-xmfv'

The NewsmanApp plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'billing_first_name' and 'billing_last_name' parameters. This affects all versions up to and including 3.7.29. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the Newsman Remarketing feature to be enabled with a configured Remarketing ID. The CVSS score is 7.2, indicating a high severity risk.