Threats tagged 'ghsa-qvrg-xmf8-qrhj'

The Zingaya Click-to-Call plugin for WordPress versions up to and including 1.0 is vulnerable to reflected cross-site scripting (XSS) via the 'email', 'first_name', 'last_name', and 'phone' parameters on its sign-up admin page. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with crafted links.