Threats tagged 'ghsa-w8x6-5chw-44wx'

The Avada (Fusion) Builder plugin for WordPress versions up to and including 3.16.2 contains a stored cross-site scripting (XSS) vulnerability via the 'tab_index' and 'empty_notice' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts into pages. The wp_kses_post function does not remove the payload because the malicious content is embedded within shortcode attribute text, which is treated as plain text rather than HTML markup.