Threats tagged 'ghsa-r8pr-jj4f-h96r'

The everviz plugin for WordPress versions up to and including 1.1 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user input in the everviz shortcode attributes, specifically the 'type' and 'hash' attributes. Authenticated users with contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages.