Threats tagged 'ghsa-ppvq-mmgv-cw4h'

The Advanced Classifieds & Directory Pro WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'phone' parameter in versions up to and including 3.4.4. This vulnerability requires that the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is placed on a sidebar on single listing pages, both of which are non-default configurations. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages.