Threats tagged 'ghsa-xwvq-x37m-5r2p'

The Mang Board plugin for WordPress versions up to and including 2.4.5 is vulnerable to stored cross-site scripting (XSS) via the 'align' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when any user views the affected page. The vulnerability arises from insufficient input sanitization and output escaping, allowing the malicious payload to persist through WordPress's wp_kses_post filtering because it contains no angle brackets. This enables script execution in viewers' browsers, including administrators previewing posts.