A Contributor-level user could inject arbitrary JavaScript via the menu divider (“menudivider”) attribute of the nested navigation menu widget. The injected script executes when a visitor loads any SeedProd-powered page that includes the affected nav-menu block. The fix in `app/nestednavmenu.php` adds `sanitize_text_field()` on the incoming `menudivider` attribute value and wraps the output with `esc_html()` before writing it into the rendered `
This vulnerability affects the following application versions:
- Website Builder by SeedProd 6.9.0.8
- Website Builder by SeedProd 6.10.0
- Website Builder by SeedProd 6.12.0
- Website Builder by SeedProd 6.12.2
- Website Builder by SeedProd 6.13.0
- Website Builder by SeedProd 6.13.1
- Website Builder by SeedProd 6.15.3
- Website Builder by SeedProd 6.15.4
- Website Builder by SeedProd 6.15.6
- Website Builder by SeedProd 6.15.7
- Website Builder by SeedProd 6.15.13.1
- Website Builder by SeedProd 6.15.15.3
- Website Builder by SeedProd 6.15.18
- Website Builder by SeedProd 6.15.19
- Website Builder by SeedProd 6.15.20
- Website Builder by SeedProd 6.15.21
- Website Builder by SeedProd 6.15.22
- Website Builder by SeedProd 6.15.23
- Website Builder by SeedProd 6.17.4
- Website Builder by SeedProd 6.18.4
- Website Builder by SeedProd 6.18.5
- Website Builder by SeedProd 6.18.9
- Website Builder by SeedProd 6.18.10
- Website Builder by SeedProd 6.18.11
- Website Builder by SeedProd 6.18.12
- Website Builder by SeedProd 6.18.14
- Website Builder by SeedProd 6.18.15
- Website Builder by SeedProd 6.18.16
- Website Builder by SeedProd 6.18.17
- Website Builder by SeedProd 6.18.18
- Website Builder by SeedProd 6.19.0
- Website Builder by SeedProd 6.19.1
- Website Builder by SeedProd 6.19.3
- Website Builder by SeedProd 6.19.4
- Website Builder by SeedProd 6.19.5
- Website Builder by SeedProd 6.19.6
- Website Builder by SeedProd 6.19.7
- Website Builder by SeedProd 6.19.8
- Website Builder by SeedProd 6.19.9
- Website Builder by SeedProd 6.19.10
- Website Builder by SeedProd 6.20.0
- Website Builder by SeedProd 6.20.1
- Website Builder by SeedProd 6.20.2