Threats tagged 'ghsa-qc47-xccv-ch2q'

The Royal Elementor Addons WordPress plugin versions before 1.7.1070 contain a vulnerability where submitted form field values are not validated before being used in email recipient addresses. This allows unauthenticated attackers to modify the recipient list and send emails from the site's domain if a recipient field echoes user input.