Threats tagged 'ghsa-wgrw-7pq3-7r4q'

The LiteSpeed Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter affecting all versions up to and including 7.9.1. This flaw arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires the HTML Minify option to be enabled and a companion plugin that renders stored comment content in a raw-text context such as a JSON-LD script block on the same page.