Threats tagged 'ghsa-phr2-h83q-x5jf'

The SureCart WordPress plugin up to version 4.9.4 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The injected scripts execute when users visit pages that load SureCart's web-component bundle, such as those containing a SureCart Buy Button block. For exploitation, the injected comment must be auto-approved or approved by a moderator.