Threats tagged 'ghsa-w8r5-69q2-3m5g'

The News Kit Addons For Elementor WordPress plugin versions up to and including 1.4.8 contain a stored cross-site scripting (XSS) vulnerability via the 'formData' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. The flaw is due to an operator-precedence bug in handle_scripts() and improper sanitization that permits encoded angle brackets to be restored and executed.