Threats tagged 'ghsa-v24h-xxp2-2j6m'

The Greenshift WordPress plugin (animation and page builder blocks) is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'comment' parameter in all versions up to and including 13.2.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. Exploitation requires specific conditions involving administrator-published pages with certain block configurations that trigger the vulnerable script processing comment excerpts.