Threats tagged 'ghsa-w4v2-754j-rcj5'

The AAA Autoload Optimizer WordPress plugin up to version 1.7.0 is vulnerable to stored cross-site scripting (XSS) via the 'option_page' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. Exploitation requires the plugin's Option Tracking setting to be in 'Legacy' mode. The vulnerability arises from insufficient input sanitization and output escaping, and it bypasses WordPress's HTTP 403 response due to filter execution order.