Threats tagged 'ghsa-vg95-f6hv-9qwv'

The Ultra Addons for Contact Form 7 WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to and including 3.5.43. This vulnerability allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The issue arises from insufficient input sanitization and output escaping.