Threats tagged 'ghsa-q9vr-qv9h-hj5f'

The CookieYes WordPress plugin versions prior to 3.5.8 have a vulnerability where users with the Contributor role can inject JavaScript into the cookie-category script fields. This occurs because the plugin does not properly restrict write access to these fields nor sanitize or escape the input, leading to potential cross-site scripting (XSS) attacks affecting site visitors and administrators reviewing content.