Threats tagged 'ghsa-rg8w-j32p-wvqw'

Presto Player plugin for WordPress versions up to and including 4.5.1 is vulnerable to stored cross-site scripting (XSS) via the comment content processed by the <presto-player> tag. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Initial comment approval is required, but subsequent comments from the same author may be auto-approved by default WordPress settings, enabling persistent exploitation.