Description
The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Comments | < 7.6.60 | 7.6.60 |
References
- https://wpscan.com/vulnerability/e77ea3fb-4d38-4fa7-a50b-1a0078f34474/ exploit vdb-entry technical-description