Threats tagged 'ghsa-w57p-mc67-f3j9'

The AMP for WP – Accelerated Mobile Pages plugin for WordPress versions up to and including 1.1.18 contains a vulnerability that allows authenticated users with custom-level access or higher to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling the do_shortcode function. The vulnerability is linked to the 'ampforwp-cat-description' setting, which is enabled by default, making most installations affected without additional configuration changes.