Threats tagged 'ghsa-wjrf-gc3h-428q'

The Visual Link Preview plugin for WordPress versions up to and including 2.2.7 contains a stored cross-site scripting (XSS) vulnerability in its visual-link-preview shortcode. This vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts that execute when other users view the affected pages.