justinnealey vulnerabilities and threats

The DesignSetGo WordPress plugin up to version 2.11.0 is vulnerable to stored cross-site scripting (XSS) via the 'tagName' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that become active when an administrator runs the plugin's block-conversion migration. Exploitation requires administrative action to activate the payload, preventing attackers from triggering the vulnerability independently.