Threats tagged 'ghsa-q2pq-rwvm-qmrr'

The Live Composer WordPress plugin versions before 2.1.23 contain a vulnerability where certain custom post type slug settings are not properly sanitized and escaped before being used in front-end links. This flaw allows high privilege users, such as administrators, to perform stored cross-site scripting (XSS) attacks even if the unfiltered_html capability is disabled, such as in multisite WordPress setups.