Threats tagged 'ghsa-phr7-7m69-7c9v'

The Magical Products Display plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the MPD Pricing Table widget. This flaw affects all versions up to and including 1.1.29 and arises from insufficient sanitization and escaping of user-supplied HTML tag names in the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters. Authenticated users with Contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages.