Threats tagged 'ghsa-w72p-j4h7-wwg8'

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_images' parameter affecting all versions up to and including 2.8.197. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the browsers of administrators or editors when they view the pending listing's edit screen. This vulnerability enables a privilege escalation chain through normal editorial workflows.