Threats tagged 'ghsa-x258-vqv6-3976'

The HTML Forms – Simple WordPress Forms Plugin for WordPress versions up to and including 1.5.5 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping in admin settings. It allows authenticated users with administrator-level permissions or higher to inject arbitrary scripts that execute when a user accesses the affected page. The vulnerability specifically affects multi-site WordPress installations and those where the unfiltered_html capability is disabled.