Threats tagged 'ghsa-pjq9-6vf2-fvvr'

The BuddyForms plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'buddyforms_form_content' parameter in all versions up to and including 2.10.6. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Exploitation requires a form configured with the public_submit option, which is enabled by default in the plugin's bundled Post Simple template. The vulnerability has a medium severity rating with a CVSS score of 5.4.