Threats tagged 'ghsa-vx89-p3j7-8xqc'

Statamic CMS versions prior to 5.74.3 and 6.24.2 contain a cross-site scripting (XSS) vulnerability in the default form notification email feature. This vulnerability allows an unauthenticated attacker submitting a form to inject HTML into notification emails sent to recipients. The issue arises because user-submitted values are rendered without proper escaping. Fixed versions 5.74.3 and 6.24.2 address this vulnerability.