Threats tagged 'ghsa-w48v-8pqw-vj5q'

The Orbit Fox plugin for WordPress versions up to and including 3.0.2 is vulnerable to stored cross-site scripting (XSS) via the category and tag 'name' parameters. Authenticated users with Author-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.