Threats tagged 'ghsa-pvqw-5gv9-r38m'

Multiple Pages Generator by Themeisle versions before 4.2.5 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with Contributor-level permissions to inject malicious scripts via the [mpg] and [mpg_match] shortcode base-url attribute. The vulnerability arises because entity-encoded payloads bypass kses filtering but are decoded and rendered unescaped in administrator browsers, enabling script execution.