The Quotes llama WordPress plugin prior to 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
quotes llama project quotes llama |