Threats tagged 'ghsa-prx4-2899-p4c2'

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin versions before 2.4.4 contains a vulnerability where it fails to validate user capabilities or ownership of targeted posts in an AJAX action. This flaw allows users with contributor-level roles to inject arbitrary JavaScript into any post, which executes when a higher privileged user edits the post.