Threats tagged 'ghsa-vj5f-vg3r-fvh8'

The Free Quotation plugin for WordPress versions up to and including 3.1.6 is vulnerable to stored cross-site scripting (XSS) via admin settings. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with administrator-level permissions or higher to inject arbitrary scripts. The injected scripts execute when a user accesses the affected page. This issue specifically impacts multi-site WordPress installations and installations where the unfiltered_html capability is disabled.