Threats tagged 'ghsa-wqmw-2cq3-rr6p'

The WP Carticon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'carticon_js_script' parameter affecting all versions up to and including 1.0.0. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated administrators to inject arbitrary scripts. The issue specifically affects multi-site installations and installations where the 'unfiltered_html' capability is disabled.