Threats tagged 'ghsa-xqcg-xmfg-qf64'

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.1.8. This vulnerability arises from insufficient input sanitization and output escaping of the 'fields[section][fields][row][col][type]' parameter. Authenticated users with shop manager-level access or higher can exploit this flaw to inject malicious scripts that execute when other users view the affected pages.