Threats tagged 'ghsa-x75g-w554-rmfv'

A stored Cross-Site Scripting (XSS) vulnerability exists in the WP Directory Kit WordPress plugin versions before 1.5.8. The plugin fails to properly sanitize and escape certain category and location fields before outputting them in page attributes. This allows users with a specific listing-management role, even without the unfiltered_html capability, to inject malicious scripts that execute for any visitor of the affected page.