Threats tagged 'ghsa-r989-vr5g-h5qp'

The Smart Cookie Kit WordPress plugin up to version 2.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires an administrator to approve the malicious comment and then view the affected post, triggering script execution.