Threats tagged 'ghsa-xvmm-73h6-8xgf'

The Qzzr Shortcode Plugin for WordPress versions up to and including 1.0.1 is vulnerable to stored cross-site scripting (XSS) via the 'qzzr' shortcode. This vulnerability arises from insufficient input sanitization and output escaping on the 'quiz' attribute, allowing authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.