Threats tagged 'ghsa-pp67-6fqf-q73f'

The SEOPress WordPress plugin versions prior to 10.4 contain a vulnerability where certain analytics tracking settings are not properly sanitized or escaped before being output in an inline script on front-end pages. This flaw allows users with a specific SEOPress capability, which can be delegated by an administrator to lower-privileged roles, to perform stored cross-site scripting (XSS) attacks. These attacks execute in the browsers of any site visitor, including logged-in administrators viewing the front end.