Threats tagged 'ghsa-vrvf-crm8-m957'

The Saphali LiqPay for donate plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'saphali_liqpay' shortcode. This affects all versions up to and including 1.0.2. The flaw arises from insufficient input sanitization and output escaping of user-supplied attributes, allowing authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.