Threats tagged 'ghsa-q737-h7j9-qw8g'

The WP User Manager plugin for WordPress up to version 2.10.2 contains a stored cross-site scripting (XSS) vulnerability via the 'name' parameter in the REST users endpoint. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because the plugin's front-end sanitization is bypassed by using the WordPress core REST endpoint, making save-time sanitization ineffective.